【作者】 张涛；

【导师】 臧斌宇；

【作者基本信息】 复旦大学 ， 计算机软件与理论， 2013， 硕士

【摘要】 随着计算机网络的飞速发展,越来越多的Linux服务器部署在网络中,信息与网络的安全形势也越来越复杂化。作为重要的信息资源,网络中Linux服务器的安全性和稳定性成为影响整个信息系统安全运行的重要因素。因此,如何对这些重要的Linux服务器资源进行实时的审计和监控成为当前研究的一大难点。从当前的研究与应用情况来看,至今还没有成熟的针对Linux服务器的安全审计产品,既能够对大规模分布式网络中的Linux服务器进行全面审计,又能通过审计信息的整合分析实现智能审计的目标,有效确保Linux服务器和网络的安全性。本文设计的安全审计系统采用灵活的系统架构和部署方式,利用Linux内核级审计与应用级审计的支持,将软件与硬件相结合,实现了对Linux服务器全方位的高效审计。此外,本系统在传统审计数据分析技术基础上整合多种数据挖掘技术,生成审计行为分类模型,为实现智能化审计提供了有力的数据支撑。论文的主要工作和贡献如下：1.本文提出的系统架构通过组件化、模块化的分离设计,保证了系统的灵活性和扩展性。系统通过多级管理中心的部署方式、服务器节点自动发现技术和通讯标签技术进一步保证整个系统的安全性、稳定性和易用性,从而使系统可以应用于大规模分布式网络系统的审计。2.本文充分利用Linux服务器的多层面审计支持,通过内核级与应用级审计相结合、软件与硬件相结合的方式来收集服务器上的各项审计信息,实现了对系统资源、终端访问、文件、数据库和网络的全面审计,并针对具体应用进行功能优化,提高了审计系统的效率。3.本文将来自不同审计源的数据进行审计信息的统一化表示,采用基于K-means聚类的属性级别的噪声清洗算法对噪声数据进行矫正,为审计数据分析提供了良好的数据支持。在审计数据分析中创造性地结合关联分析、聚类分析和分类分析的数据挖掘技术,形成审计行为分类模型,实现了审计系统的智能化。4.本文实现的系统在实际的应用测试中在功能上和性能上都取得了良好的效果,具有一定的理论意义和较好的实用价值。更多还原

【Abstract】 As the rapid growth of computer networks, more and more Linux servers are deployed. With the information and security situations becoming more complicated, the deployed Linux servers which usually manage critical information attracts a lot of attention for its security and stability. It becomes a big research problem to develop a real-time audit and monitor solution for these mission-critical Linux servers.Existing work are not readily applicable to auditing and monitoring Linux servers at real time. They are limited either in the scalability to perform comprehensive audit in a large distributed network, or in the intelligence which could filter masses of normal audit messages smartly while not harm the effectiveness of the audit system.This dissertation designs a flexible architecture and a new deployment method to adapt to large networked systems. To accomplish comprehensive audit against various system events, this dissertation combines kernel-level and application-level support and relies on the software-hardware co-design to improve the efficiency. Besides, this dissertation also uses several machine learning techniques to mine a behavior classification model and integrates the model into the audit system to improve its intelligence. Specifically, this dissertation makes the following contributions.First, this dissertation proposes modular, loosely-decoupled system architecture to gain flexibility and scalability. Through a multi-layer deployment method and an automatic node discovery algorithm, our system achieves good usability and high stability which makes it suitable for large-scale networks. At the same time, this dissertation improves the integrity of the audit message by tagging.Second, this dissertation uses the audit support from Linux kernel and critical system applications to efficiently collect effective audit events. Our solution also uses hardware software co-design to reduce the monitoring overhead.Third, this dissertation invents a uniform representation to handle audit events from different sources. By using associative analysis with clustering and classification techniques, our system mines an audit behavior model which could deal the masses of audit message to make our system more intelligent.Finally, this dissertation is showed to achieve good results in functionality and performance when deployed in a real-world large distributed system.更多还原