校園網路安全事故自動防治系統之設計與實作

Design and Implementation of an Intelligent Defense System against Network Security Indidents

賴守全 ； 謝木政 ； 郭文曲

《網際網路技術學刊》 4卷2期 (2003/04) Pp. 119-126

摘要

網際網路的快速發展，給人們帶來了極大的便利，但隨之而來的網路攻擊、網路入侵、病毒感染、廣告信泛濫等問題，也帶來了相當的傷害，Code Red蠕蟲(Worm)事件[１]，就是典型的案例。對於這類破壞、濫用網路的行為，我們稱之為『網路安全事故』（Network Security Incidents），這些事故可以在極短時間內，癱瘓網路、破壞資訊，嚴重危害網路安全。因此，防止網路安全事故的擴大，免除非必要的網路擁塞，避免網路資源被不當使用，成為網路中心必需重視的一圈課題。網路中心發現事故後，通知電腦使用者自行處理的作法，對破壞力日益強大的網路安全事故，顯然緩不濟急。為確保整體網路的正常運作，一旦發現嚴重事故後，我們認為應立即阻斷事故來源的網路，才能有效降低傷害。在本文中，我們提出異常偵測、網路阻斷、自動通告的標準程序來處理網路安全事故，並在校園網路的環境下，整合多種偵測網路異常的方法，以校園網路的路由器及伺服器等設備，實作出『校園網路安全事故自動防治系統』，有效地圍堵了網路安全事故疫情（如：Code Red、Nimda蠕蟲）的蔓延。

關鍵字

網際網路 ； 網路安全 ； 網路管理 ； 網路攻擊 ； 電腦病毒 ； 電腦蠕蟲 ； 路由器

並列摘要

With rapid growth of Internet, it’s more convenient for technical research and information exchange. However, network incidents, such as network attack, network invasion, network virus and spam mails, also occur more frequently and severely than ever. The incident of Code Red worms is a typical example. In this paper, we call these behaviors which disturb normal operations of networks as “Network Security Incidents.” These network security incidents could, in a very short time, damage the network and information structure. They have become vital threats to network security. Therefore, it is important for the network operation center to stop the spreading of network security incidents and avoid the abuse of network resources. To reduce the impact caused by network security incidents, it is desired to isolate infected hosts from the network. In this paper, we proposed a standard operation procedure to handle network security incidents. Based on this standard operation procedure, we have designed and implemented an intelligent defense system against network security incidents. The intelligent defense system will automatically detect and isolate infected hosts from the network. The results show that it can stop the wide-spreading of network security incidents efficiently.

並列關鍵字

Internet ； Network Security ； Network Management ； Internet Worms ； Network Security Incident