基于SVM方法的DNS服务攻击防范模型

【作者】 钟霖甘；

【导师】 孙慰迟；

【作者基本信息】 复旦大学 ， 软件工程， 2009， 硕士

【摘要】 域名系统(Domain Name System,DNS)已经成为Internet最关键的基础设施。2008年,Dan Kaminsky公布的针对DNS协议缺陷的CNiping攻击,使DNS服务攻击防范问题受到全球广泛关注。DNS服务攻击防范的前提是要正确检测出针对DNS的入侵行为,入侵检测问题可转化为模式识别问题。支持向量机(SVM)是建立在统计学习理论上的模式识别方法,它具有运算速度快、扩展能力强等优点,将之应用于网络入侵检测,可以提高检测性能。论文针对DNS通信的特点设计了DNS服务攻击防范模型,其核心的入侵检测系统使用SVM方法来实现。论文首先介绍了DNS的发展、系统结构和工作原理;其次分析了目前DNS系统主要存在的三类安全问题,并分析了用于保障DNS安全的DNSSEC和TSIG;然后介绍了入侵检测和SVM的相关概念。在这些理论的基础上,设计基于SVM方法的入侵检测系统。该系统从原始网络数据中提取出每条网络连接的41个特征,然后将字符型的特征转化为数值,利用异构数据集上的奇异距离函数对数据进行归一化处理,生成支持向量机的输入矢量。SVM模型选择了用于分类的C-SVM算法和Mercer核函数,通过训练后生成检测规则库。最后,利用该入侵检测系统设计了DNS服务攻击防范模型。该模型基于Linux操作系统,采用LinuX环境下的开源软件和开发工具,实现了防火墙、DNS服务、日志、数据捕获和SVM入侵检测系统,每一个模块都针对DNS服务进行必要的安全配置。论文通过对CNiping攻击的原理和效率进行分析,可知在DNS服务中使用随机端口,能增加攻击者进行缓存投毒的难度,使系统有足够的时间进行响应。在实验中,系统可以有效检测出CNiping攻击,并自动封禁被攻击的端口,保障DNS服务的安全。更多还原

【Abstract】 DNS has being a key Internet infrastructure. In 2008, Dan Kaminsky released CNiping attack method, which imposes a bug of DNS protocol. It arouses wide concern of protecting DNS service from attacks. To protect DNS, it must accurately detect the intrusions against DNS service. Intrusion detection can treat as pattern recognition. SVM based on statistical learning theory is a pattern recognition method. It has many advantages such as high processing speed, power extensibility. Applying SVM to intrusion detection can improve the performance.The thesis proposed a DNS service defense system model based on the characteristics of DNS communication. The key module of the model is SVM IDS. Firstly, the thesis summarizes the development, system architecture and working principle of DNS. Secondly, it introduces the main three secure problems of DNS, and analyses DNSSEC and TSIG, which are designed for securing DNS. Thirdly, it introduces some related knowledge about intrusion detection and SVM. On the basis of the theories, a SVM IDS is proposed. The IDS analyses 41 features of each network connection from original network datas, and converts the character format features to numeric. Then, it normalizes the datas by using upper distance of isomerism data collection function HVDM and creates input vectors. It makes use of C-SVM algorithm and Mercer kernel function for SVM model. It creates a database of intrusion detection policy after trained. At last, a DNS service defense system model using the SVM IDS is designed. The model is based on Linux. It uses open source softwares and development tools to implement firewall, DNS service, syslog, sniffer and SVM IDS. Every module is well configured to protect DNS service.The thesis analyses the principle and efficiency of CNiping. The conclusion is using random port numbers of DNS service can increase the difficulty of Cache Posioning, so that the defense system have enough time to respond. In the experimental test, the proposed model can effectively detect CNiping attack, and automatic ban the port number being attacked. It well protects the DNS service.更多还原