網路入侵偵測之改良

Improvement of Network Intrusion Detection

楊凱翔(Kai- Siang Yang)

指導教授 ： 吳昌憲

國立虎尾科技大學/管理學院/資訊管理研究所/碩士(2014年)

摘要

目前科技趨勢而言，網路已經提供相當便利的服務，但網路的安全性，一直以來都是嚴峻的議題，許多學者們在此領域投入不少的研究，也提出策略及其解決的方法。雖然阻止了大部分的入侵攻擊，但入侵者攻擊的方式日新月異，因此需要進一步的探討。

建置在網路服務架構上的傳統入侵偵測系統(Intrusion Detection Systems; IDS)，無法獲得如預期的效益。高度錯誤警報是目前IDS困擾的問題所在，也是未來資訊安全方面的一個隱憂，因為任何一個錯誤警報都會影響到之後的偵測與預防入侵。本研究針對了Snort的SYN Flood 規則，利用Hping3 發出攻擊，進而改良原先規則，以提升網路服務安全。

關鍵字

入侵偵測系統 ； 網路服務 ； Snort

並列摘要

Nowadays the technology trend is booming, the network provides fairly convenient service, but the network security always has been a serious issue. Many scholars put a lot of effort in this research domain. The strategy and associated solution are also proposed. Although at present the majority of intrusion attack has been prevented, the aggressor attack changes its way with each new day. Therefore the further discussion is needed.
The traditional intrusion detection system (Intrusion Detection Systems; IDS) built upon network is unable to obtain the anticipated performance. The highly false alarm with current IDS is the key problem, since any false alarm misleads incorrect detection and prevention of intrusion. This will cause troublesome worry for future information security. Thus in this research, the Snort rule for SYN Flood is aimed and refined by sending out the Hping3 attack. Hopefully contribution is made to elevate safety for the network service security.

並列關鍵字

Intrusion Detection System, ； Network Service ； Snort

參考文獻

[1]Patel, A., Taghavi, M., Bakhtiyari, K., & Celestino JuNior, J. (2013). An intrusion detection and prevention system in cloud computing: A systematic review. Journal of Network and Computer Applications, 36(1), 25-41.

[2]Scarfone, K., & Mell, P. (2007). Guide to intrusion detection and prevention systems (idps). NIST special publication, 800(2007), 94.

[3]Choo, K. K. R. (2011). The cyber threat landscape: Challenges and future research directions. Computers & Security, 30(8), 719-731.

[4]Spathoulas, G. P., & Katsikas, S. K. (2010). Reducing false positives in intrusion detection systems. computers & security, 29(1), 35-44.

[5]Pietraszek, T., & Tanner, A. (2005). Data mining and machine learning—towards reducing false positives in intrusion detection. Information Security Technical Report, 10(3), 169-183.