【作者】 杨锋；

【导师】 钟诚；

【作者基本信息】 广西大学 ， 计算机应用技术， 2005， 硕士

【摘要】 入侵检测技术作为一种主动的安全保障措施,有效地弥补了传统网络安全防护技术的缺陷。随着分布式攻击的频繁出现,传统的基于单机的入侵检测系统已经不能满足系统的安全需求。在分布式网络环境下,位于不同结点之间的攻击者可能会协同起来对同一个服务器进行攻击。如果单独检测各个用户的操作序列,是难以发现其入侵行为的,因为单个攻击者的操作序列不足以构成产生入侵行为所需的信息。但是,如果将这些分散的操作序列组合起来,它们很可能就是事实上的入侵行为。现有的入侵检测方法难以有效地检测这种分布式的入侵行为。本文主要研究分布式环境下的协同入侵检测方法。 首先结合模糊理论提出基于概率模糊认知图(PFCM)的攻击图来描述入侵行为;设计一种结合误用检测和异常检测的基于PFCM的混合入侵检测方法,用模糊概念描述异常,用数值运算代替模式匹配,并利用概率测度有效表示各因素间关系的不确定性;构造基于PFCM的Smurf攻击图并进行检测实验。实验结果表明该方法能在保持高检测率的情况下降低误报率,并具有较好的鲁棒性。 在基于PFCM的混合入侵检测方法的基础上,结合入侵策略的阶段性分析技术,提出基于PFCM的分布式攻击图来描述分布式攻击,利用概率测度表述事件间的时序关系、约束关系和关系的不确定性,并合理利用单点检测结果,减少系统的信息传输量;构建分层与分散结合的分布式协同更多还原

【Abstract】 The intrusion detection technique is an essential component of the critical network security mechanisms. Nowadays, with the wide application of the distributed computing environment, the traditional intrusion detection systems, which only concern the local network environments or a single host, are proved to be not sufficient. Many attackers on different nodes attack coordinately the same target in the distributed network. If the user’s operation sequence is detected singly, the system difficultly detects the true intrusion behavior because the single operation sequence doesn’t consist of the necessary information. However, when these different operation sequences are combined on a certain mode, they are likely to form a true attack. It is difficult to detect effectively these distributed attacks by the current intrusion detection approaches. The distributed coordinated intrusion detection approach is researched in this paper.Firstly, the attack map based on probabilistic fuzzy cognitive map (PFCM) is constructed to describe the intrusion behaviors by applying fuzzy theory. By considering various factors of intrusion and integrating misuse detection with anomaly detection, a PFCM-based hybrid intrusion detection approach is presented. It describes anomaly as fuzzy conception, executes numerical operations instead of pattern matching, and expresses the uncertainty of relations of the factors by applying probability measure. The PFCM-based Smurf attack map is constructed and experimented. The test results show that the approach is robust and can keep high detection rate with lower false positive rate.Secondly, based on the PFCM-based hybrid intrusion detection approach, the PFCM-based distributed attack map is constructed to describe the distributed intrusion behaviors by applying the phase analysis technology of intrusion strategy. This attack mapconsiders consequence of various factors in distributed intrusion, and expresses the temporal sequence, the restriction and the uncertainty of relations of the factors by probability measure. A distributed coordinated intrusion detection system structure is designed, and it is used to perform the coordinated intrusion detection in three aspects that are the coordination in data collection and data analysis and response. A PFCM-based coordinated intrusion detection algorithm is presented. The PFCM-based Mstream attack map is constructed and experimented. The test results show that the approach is robust and can detect the type of the distributed attack and judge the degree of the distributed attack.更多还原