於Gigabit被動光纖網路下MSN/SIP會談鑑識系統之設計與實作

網路鑑識是運用各種網路協定技術分析網路封包，透過收集、分析、過濾、比對等方法找出可疑的封包，以防止進一步的危害事件發生。然而，隨著網路傳輸速度的加快，同時也延伸許多網路安全問題，直接縮短駭客搜尋與攻擊的時間，也增加網路鑑識之困難度，來不及追蹤與紀錄網路非法行為。一般傳統網路鑑識主要是以IP層封包鑑識為主，但網際網路應用大多以會談為基礎，會談應用的特性都是在通訊期間才決定動態資料通道，並且動態交換會談媒體格式資訊 (如：Session Descript Protocol; SDP)，因此，已經無法從單純的網路層與傳輸層標頭資訊來判斷網路封包類別。本論文利用GPON架構設計與實作MSN/SIP會談鑑識系統，並且運用兩層封包分類結構，將非狀態式分類負載分散至用戶端ONU，並利用UDP Tunnel方式集中處理少數封包之會談分類與協定分析，將封包傳送至嵌入式MSN/SIP會談鑑識系統，接著，會談鑑識系統將會談狀態資料儲存至後端資料庫系統，以提供管理者查詢與追蹤使用者會談狀態與行為，及網路安全鑑識與網路安全決策的重要參考資料。本論文透過負載測試結果顯示，會談鑑識分析器於負載43MB內，準確率達90%以上，符合我們在GPON環境上的需求。

關鍵字

會談起始協定； Gigabit被動光纖網路；網路鑑識；會談分類；網路安全

並列摘要

The network forensics is to analyze network packets with various network protocols. The methods, such as packet collecting, analyzing, filtering, comparing, are used to figure out the dubious packets to avoid the further-harm events. However, with the network-speed increasing rapidly, many network security problems are expanded. The searching and attacking time for crackers are shorten directly; moreover, the difficulty of network forensics is increasing, and the illegal network behavior cannot be traced and recorded exactly in time. In general, network forensics focuses on IP-level network forensics, but most internet applications are based on session communication. The characteristic of session applications is that the data channels are decided dynamically during the session communication. The media formats are exchanged dynamically, such as Session Descript Protocol (SDP). The network-packet class cannot be identified exactly according to its network-layer header and transport-layer header information. Therefore, the thesis design and implement a MSN/SIP session forensics system based on GPON with two-level classification. The heavy loading is distributed on GPON ONU by using stateless classification method. The few related packets of MSN and SIP applications are classified and forward to analyzer with an UDP tunnel. Finally, the information of session state is stored to the backend database management system. MSN/SIP session forensics system provides administrators to query and trace the users’ session state and behavior that can give a significant reference to define network security forensics and network security policies.The load test result of the paper shows that the accuracy rate is higher than 90% when the session forensics analyzer has a load within 43MB, which meets the GPON environment requirements.

並列關鍵字

SIP (Session Initiation Protocol) ； GPON (Gigabit Passive Optical Network) ； Network Forensics ； Session Classifier ； Network Security

參考文獻

[2] H-K. Su, C-S. Wu and K.-J. Chen, "Session Classification for Traffic Aggregation," IEEE International Conference on Communications 2004 (ICC 2004), June 23, 2004.

[6] G. Kramer, G. Pesavento, “Ethernet Passive Optical Network (EPON): Building a Next-Generation Optical Access Network,” in IEEE Communication Magazine, pp.66-73, February 2002.

[9] A. Rafiq, S.M.H. Zaidi, M. Ramzan, Y. Raja, N. Ghani, "Time quantum based online scheduler (TQOS) for WDM EPON," International Symposium on High Capacity Optical Networks and Enabling Technologies (HONET 2007), pp.1-6, 18-20 Nov., 2007.

[10] S. Hussain, X. Fernando, "EPON: An extensive review for up-to-date dynamic bandwidth allocation schemes," Canadian Conference on Electrical and Computer Engineering (CCECE 2008), pp. 511-516, 4-7 May, 2008.

[11] S.R. Sherif, A. Hadjiantonis, G. Ellinas, C. Assi, M.A. Ali, "A novel decentralized ethernet-based PON access architecture for provisioning differentiated QoS," Journal of Lightwave Technology, vol.22, no.11, pp. 2483-2497, Nov. 2004.

國際替代計量

於Gigabit被動光纖網路下MSN/SIP會談鑑識系統之設計與實作

未授權

主題瀏覽