【作者】 周鹏；

【导师】 龚俭；

【作者基本信息】 东南大学 ， 计算机系统结构， 2005， 硕士

【摘要】 随着互联网技术的不断发展,网络入侵技术也不断进步。其中,针对网络入侵检测系统NIDS(NetWork Intrusion Detect System)的变体攻击技术具有很强的隐蔽性和可利用性,造成越来越大的危害。变体攻击中,会话流重组和URL编码变体攻击相对来说较难检测。目前,NIDS针对这两种攻击有缓存法和在线分析法两种检测技术。缓存法相对比较成熟,但是这种技术对NIDS系统的内存容量和I/O性能依赖较高,无法同时检测大量的并发会话流。在线检测技术还处于初级阶段,不能检测到URL编码变体攻击,而且其性能仍然不够理想。本论文以网络入侵防范系统Monster为研究背景,对已有的在线检测技术进行改进,提高检测性能,并增加对URL编码变体攻击的检测能力。在线检测技术下,分组重组和分组扫描是同时进行的,因而比缓存法节省检测系统重组所需的缓存。但是,在线检测技术的分片扫描为了给分片重组提供必要的摘要信息,不能使用NIDS常用的多模式精确匹配算法,如AC、BM等。多模式精确匹配算法DawgMatch能够满足分片重组的需要,但该算法的性能低于AC算法。论文使用加权边技术消除了DawgMatch在扫描过程中的回溯现象,从而提高了DawgMatch算法的运行性能。分析结果显示,改进后的DawgMatch在理论复杂度与AC算法近似,并且实际性能也在DawgMatch与AC算法之间。同时,论文还对现有的分组重组进行改进,利用推导出的对等因子切换公式解决了原有的技术下分组检测时不能完全拼接的问题,进一步降低了在线检测技术所需的缓存空间。理论分析证明,在极限情况下,改进后的空间占用是改进前的1/2。针对在线检测技术不能处理URL编码变体攻击的问题,论文在对URL编码研究的基础上,提出了在线解码限制的概念,它描述了在线检测技术所能处理的编码。论文还借鉴了DawgMatch的思想,提出了在线解码算法HOD。该算法可以对所有符合在线解码限制的编码实行译码,包括目前已知的所有URL编码。分析结果显示,HOD的理论复杂度与原有的在线检测技术近似,没有明显降低系统性能。论文将所提的算法应用于抗变体的会话流检测模块AASOA,该模块处于Monster系统中的报文检测部分。利用NIDS评估工具AOLES系统对Monster进行评估后的结果表明,改进后的Monster系统能够可以稳定处理200kpps左右的网络流量。即使是并发流数超过500k,会话到达率110k/sec的极限情况下,Monster系统仍然能够正常运作。在会话重组检测领域中,目前已知的测试报告没有更高的数据记录。论文最后对研究工作进行了展望,指出了增量式规则更新技术以及对更多编码的处理能力是将来研究工作的重点。更多还原

【Abstract】 With the continuous development of Internet, network intrusion techniques are also keeping evolving. NIDS(Network Intrusion Detection System) is one of the effective tools to prevent intrusions. However, anamorphosis intrusion techniques can escape NIDS easily, which faces Internet with greater threat. Among all of the anamorphosis intrusion techniques, tcp-session- assembly-intrusion and URL-encoding-intrusion are the most popular problems of NIDS. Up to now, there are two techniques to handle with anamorphosis intrusion, offline-assembly technique and online-assembly. Comparably, Offline-assembly technique is more mature. However, such technique consumes excessive memory, and its performance is limited by the performance of memory I/O, so that it can not deal with too much parallel tcp streams. Online-assembly technique is burgeoning, but it can not detect URL-encoding-intrusion, and its performance is not very good too. This thesis researches on anamophosis attack, aiming at enhancing performance of Online-assembly, with Monster, an intrusion detection system, as its application background.Online-assembly consists of two processes: packet assembly and packet scanning. They are running synchronously. So it is more space-saving than offline-assembly. But the process of packet scan need to provides abstracts of packet for packet assembly. Thus, traditional multi-patterns match algorithms, such as AC, BM, are not suitable for such a purpose. DawgMatch can obtain abstract of packet, but its performance is lower than AC. This thesis eliminates backtrace problem of DawgMatch by introducing weighted edge. The analysis results show that the performance of improved DawgMatch is near to AC’s in theory and practical environment. What’s more, this thesis resolves the problem of incomplete assembly with a deduced peer-fact-switch formula, which can save half space consumed than before in the worst condition.Based on the research of URL encode, this thesis introduces the concept of online-decoding restriction, which describes the ability of online-decoding. This thesis also designs a online-decoding algorithm—HOD, which is similar to DawgMatch. HOD can handle with any encodings which fills with the online-decoding restriction, which covers all URL encodings today. The performance of HOD is similar to DawgMatch in theory and practical environment.The thesis puts DawgMatch and HOD into application in Monster and uses AOLES, a NIDS analysis tool, to make an assessment of them. From the experiment, Monster can deal with high-speed network flow up to about 200kpps steadily. Even in the worst environment, in which parallel tcp streams counts over 500k and new session rate reach about 110k/sec, Monster still works well. The results are among the best today.In the end, the thesis prospects the further study in anamorphosis attack, including the algorithm of incremental rule compiler and more ability of online-decoding.更多还原