基于主动网的自适应入侵响应系统的研究与实现

【作者】 甘迎辉；

【导师】 秦志光；

【作者基本信息】 电子科技大学 ， 计算机应用技术， 2003， 硕士

【摘要】 对用户来说，网络安全体系中检测者和响应者同样重要。然而对两者的研究却大不相同，长期以来，响应技术的研究未受到重视。实际应用中的网络安全产品把响应模块的任务留给了用户完成，这使响应大大滞后于攻击，入侵成功的机会较大。显然，手工响应已不能有效阻止当前自动化程度不断提高的网络攻击。同时，现有安全组件各自为阵，缺乏协调，响应局限于受攻击子网内部。将入侵响应局限在受攻击子网或受攻击安全管理域内，不能有效阻挡日趋严重的分布式攻击。在受到分布式攻击时，当前的做法是关闭服务甚至关闭系统，这对于一些提供关键数据服务的系统是不能接受的，即使应用可以接受，这显然也不是一种最优策略。 本文构建了一个将入侵检测系统、路由器、交换机、防火墙、主机和其它安全组件融合的安全防御体系。它建立在主动网的基础之上，利用主动网的观念和技术实现跨网络安全管理域的响应。结合入侵追踪技术，优化响应实施位置，在攻击源头或接近攻击源头的位置切断攻击流，文章认为这是应对分布式攻击的一种切实可行的方案。 自适应入侵响应系统是一个自动化响应系统，同时支持多个入侵检测系统对网络进行监视。系统通过计算报警可信度，限制入侵检测系统误报警所产生的负面影响；通过判断报警信息是新一轮攻击还是原有攻击的继续，动态分析攻击，调整攻击类别，评估威胁，并根据受保护系统的安全需求、相关政策、以及响应成功率确定响应机制。这些措施使防御有的放矢，安全政策按需部署，响应耗费得到优化。 此外，文章还描述了几个重要的安全组件：攻击吸收、入侵追踪、网络陷阱、双机热备份的功能和实现细节。最后，文章给出了项目的测试结果。更多还原

【Abstract】 To the users, both detector and responder play the same important role in counteracting network-based intrusion. For a long time, the researches to them are different. The researches on respond technique are always being ignored. The majority of current network security systems react to attacks by generating reports or alarms. Then the system administrator initiates a manual response action. This introduces a window of vulnerability between when an intrusion is detected and when action is taken to defend against the attack. Manual responses do not counter automated and sophisticated attacks in a desirable manner. Further more, current network security technology lack cooperation and correlation between each safe system. Current security systems detect intrusion locally and response locally. This technology can’t identify true source of attacker, and effectively respond to attacker in entire network level. Existing approaches in defending DDoS intrusions is just close service even close the system. But it is improbable for some crucial service. Even the application could accept, obviously, it isn’t a kind of superior strategy.This paper set up a security system, which correlate routers, switches, firewalls, and hosts. Based on active network, this system making use of active network concepts and technology to automated respond to DDoS attack in entire network level. Through intrusion tracing, it could block, contain and isolate intrusion close to the source of the intrusion.Adaptive Intrusion Response System (AIRS) could make automatic response to intrusion and support for multiple IDS which monitor network and generate intrusion alarms. AIRS classify whether the incident is a continuation of an existing incident or is a new attack, dynamic analysis the incident, cataloging the attack and limit the response based on legal, ethical, institutional or resource constraints. Adaptive intrusion response strategies are suggested based on the alarm confidence, attack frequency, assessed risk, and estimated response costs.On the other hand, this paper describes the function and the technical details of a few response modules, which include Intrusion Blocking and Containing, Intrusion Traceback, Honeypots and Dual-Computer System. In the end, it describes the test result of this project.更多还原