【作者】 刘玉转；

【导师】 杨文伟；

【作者基本信息】 广东工业大学 ， 计算机应用技术， 2008， 硕士

【摘要】 随着网络安全越来越受到重视,入侵检测系统(Intrusion DetectionSystem,IDS)成为目前网络安全领域内一个活跃的研究课题。目前各种IDS普遍存在的问题是漏报和误报现象严重,响应能力不足。蜜罐是一种没有任何产品价值的安全资源,具有转移攻击者视线,收集攻击信息的作用。相对于防火墙日志、系统日志以及入侵检测预警等,蜜罐所产生的数据量少而精,这些数据对研究新型攻击具有重要价值。本文的研究目的是如何利用蜜罐发现未知攻击特征,提高入侵检测系统的响应能力和检测能力。本文首先分析了入侵检测技术与蜜罐技术的工作机制及优缺点,然后设计了一种动态混合蜜罐模型,应用该模型改进入侵检测系统,并对其关键技术进行了实现。动态混合蜜罐模型主要包括诱骗模块和伪装服务模块,两个模块之间通过转发机制协同工作。诱骗模块由低交互蜜罐组成,模拟网络中的操作系统和服务,主要作用是充分吸引攻击者,扩大蜜罐被攻击的概率;伪装服务由高交互蜜罐组成,采用真实的有漏洞的操作系统和服务,作用是给攻击者提供更加真实的环境,充分调动攻击者的热情,以充分捕获未知攻击的信息。诱骗模块具有部署简单和低风险的特点,可以分布在网络的各个角落,使入侵者陷于虚实结合的网络环境;伪装服务模块部署代价高、风险大,所以被部署在一个单独的高度受控的子网内,接收多个诱骗模块转发的连接,在与攻击者交互的过程中捕获攻击信息。本文采用多层数据捕获机制:网络捕获、蜜罐捕获和内核捕获。用多层捕获机制可以充分记录攻击的网络数据和主机数据,确保数据的完备性。内核捕获主要是针对入侵数据加密的情况,是在伪装服务中的高交互蜜罐主机上实现的。采用XML语言设计规范的入侵信息描述格式。在对IP、TCP、UDP和ICMP等常用协议分析的基础上,提出了在各种数据包中可选的参考特征。采用攻击树的方法重构攻击过程,提取复杂入侵特征。采用SQL蠕虫测试系统的收集能力和分析能力,试验表明该模型可以扩大蜜罐的视野,生成入侵特征,降低入侵检测系统的漏报率,提高入侵检测系统的性能。该系统还存在一些不足之处,未来应进一步研究如何实现高交互蜜罐的自动设置和管理;如何实现入侵数据的标准化表示,以便实现与其它安全产品的信息交互。更多还原

【Abstract】 With the increasing importance of network security, Intrusion Detection System (IDS) has become an active research topic in the field of network security. Now all kinds of IDS have common problems which are serious miss reports and wrong reports, insufficient response capacity.Honeypot is a security resource without any valuable products, which can transfer the attackers’ attention and collect the attacking information. Compared to the firewall log, system log and early warning by IDS, the data generated by honeypot is much more less. These data has an important value on researching the new invasion.The aim of this paper is how to use honeypot to find unknown signature to improve the response capability and detection capability of IDS.This paper first introduces the basic concepts, advantages and disadvantages of IDS and honeypot, then designs a dynamic hybird honeypots model, use this model to improve IDS, and implementes its key technologies.The dynamic hybrid honeypot model proposed in this paper includes decoy module and camouflage service module. Through connection redirection, the two modules work cooperatively.Decoy module is composed by low interactive honeypots, simulating the operating system and network services. Its role is to attract intruders as more as possible to improve the probability of honeypot being attatcked, using true operating system and services with loopholes. Camouflage service module is composed by high interactive honeypots.Its role is to provide more real environment and fully mobilize the enthusiasm of the intruders, so to fully capture attacking information. Decoy module is simple to deploy and have low risk, so can be distributed to every corner of the network, trapping attackers in real and virtual network situation. Camouflage service module has high deployment-cost and high risk, so is deployed in a separated and highly controlled subnet, receiving connections redirected by more than one decoy module, capturing attacking information in the process of interacting with the attackers. This paper uses multi-data capture mechanism: network capture, honeypot capture and core capture. Using multi-capture mechanism to fully record the network data and host data and to ensure the completeness of the data. Core capture is mainly against the invasion of data encryption, and is implemented on high interaction honeypot in the camouflage service module.Using XML language design intrusion information description to format the invasion data.Based on analysis of common protocol such as IP, TCP, UDP and ICMP, proposed reference signature that can be extracted from data packets. Use attacking tree to reconstructe attacking process, extracting complex intrusion signature.Using SQL worm to test capabilities of system in data collection and analysis,experiments show that this model can expand the horizons of honeypot ,generate intrusion signature, reduce the rate of miss reports and improve the performance of intrusion detection system.This system also has some shortcomings.In future we should further study how to automatic setup and manage high interaction honeypots; how to achieve the standardization of attacking data, in order to exchange information with other security products.更多还原