以入侵偵測系統為基礎

Size: px

Start display at page:

Download "以入侵偵測系統為基礎"

境向
7 years ago
Views:

1 An Intrusion Detection System for Automatic Web Page Content Filtering and Blocking

2 i

3 URL ii

4 Abstract Today the network is widely used to transmit information and link resources. However, there are many malicious activities under the network environment. For example, Worms, Spy software, Hackers and Trojan horse programs can be used to attack a computer or steal data from a computer. Hence, security management plays an important role in today s network management tasks. Although, many companies use firewalls to defense the attacks from outside, but it can t ensure the security of the whole computers inside the firewalls. That is, we need a real time intrusion detection system to assist the firewalls. In this paper, we present a flexible, intrusion detection system for the automatic content filtering and blocking of web pages. That is, using our system the users can be protected from the attacks of computer viruses or Trojan horses resides in web pages. Our system may also be used to block improper information, such as pornography from webs. KeywordsIntrusion Detection, Network Security. iii

5 Snort Snort Snort Snort Snort iv

6 v

7 Snort Snort Snort Rule Tree Snort Decode Structure Snort s Detection Engine TCP/IP SYN DDoS IDS URL vi

8 4.1 URL snort snort URL vii

9 (Internet) (Worm (DoS, Denial of Service Attack) [1] (Hacker) (Virus) (Backdoor) (Network Security) (IDS, Intrusion Detection System) (Firewall) (Application Layer) (Backdoor) (Web Server) 1

10 Web Service (IDS, Intrusion Detection System) (Alert) (Firewall) (Network Layer) (Transport Layer) (Application Layer) IP Session (Proxy Server) 2

11 3

12 (Internet) (Firewall) [2] 爲 (Anomaly Detection System)[3] (Misuse Detection System)[4] (log) 4

13 (logs) (checksum hash, digital signature) (port) 5

14 [5] [6] (Packet) 6

15 (Packet) [6] (Misuse Detection system) (Signature-based Detection) (Signature) (Signature Matching) (False Positive, False 7

16 Alert) [9 (Anomaly Detection System) [3] (Neural Network)[12] [9] (False Positive, False Alert) 8

17 Snort (IDS, Intrusion Detection System) Snort Snort [10] (open source) Snort Libpcap (Misuse Detection) (Rule-based) CGI SMB DDoS Snort (log) yslog (Misuse) 9

18 (False Positive)Snort (Plug-Ins) Snort Snort Snort (Packet Capture and Packet Decoder) TCP/IP Libpcap (Detection Engine)Snort (Linking Structure) 10

19 / (Logging and Alerting Subsystem) TCPDUMP Syslog Snort 産 Snort (Packet) [11] 産 1 (Protocol Match)Snort IP/TCP/UDP/ICMP TCP (flag) TCP TCP F ( FIN)S ( SYN)R( RESET)P( PUSH)A( ACK)U( URGENT) Snort alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"scan SYN FIN";flags:SF,12; reference:arachnids,198; classtype:attempted-recon; sid:624; rev:2;) flags TCP 2 (Signature Match) 11

20 Snort alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"web-client readme.eml download attempt"; flow:from_client,established; uricontent:"/readme.eml"; nocase; classtype:attempted-user; sid:1284; reference:url, rev:9;) /readme.eml Snort (Preprocessors) Fragment Reassembly (fragmentation) 3 Snort alert tcp $EXTERNAL_NET any -> $HOME_NET 3372 (msg:"dos MSDTC attempt"; flow:to_server,established; dsize:>1023; reference:bugtraq,4006; classtype:attempted-dos; sid:1408; rev:5;) dsize 1023 麽 4 5 ( ) 産 IP1 100CGI 麽 CGI 12

21 Snort Snort [12] [13] Snort (Preprocessors Plug-ins (Output Plug-ins) (Keywords) (Rule Parser) 2.5 [12]Snort (Rule Set) RTN(Rule Tree Nod RTN OTN(Optional Tree Nod PcapLoop 13

22 2.5 Snort Rule Tree (Reassembling Packets) (Decoding protocols) (Nonrule or Protocol anomaly-based detectio) stream4 frag

23 Snort Decode Structure [12] nort Packet Rule Tree Nod Rule Tree Nod Optional Tree Nod 2.7 Snort s Detection Engine 2.6 Snort Decode Structure Snort 15

24 SnortDDoS 2.7Snort s Detection Engine Snort (Rule) (Log) Snort 爲 (Rule Header) (Rule Options) Action Protocol SourceIP Port DestinationIP Port ( Option ) Rule Header Rule Option 16

25 (Rule Action) (Protocol) (source)ip (port) (destination)ip Rule Action PassLogAlertDynamic Activate ICMP TCPIP UDP Snort log udp any any -> $HOME_NET UDP msglogtottliddsizecontenturicontentoffset depthnocaseflagsseqacksessionflowpriorityicodeitypereference classtypesidrev Snort content "javascript\:// alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"web-client Javascript URL host spoofing attempt"; flow:to_client,established; content:"javascript\://"; nocase; classtype:attempted-user; reference:bugtraq,5293; sid:1841; rev:3;) Snort IP Snort 17

26 Proxy Server 2.8 (Browser) 18

27 (Web Server) (Web Page Cache 1 request

28 1 (Caching) 2 (Protocol Handling) (Hyper Text Transfer Protocol) (File Transfer Protocol) ICP(Internet Cache Protocol) URL(Uniform Resource Location) 3 (Garbage Collection 4 (Filtering 5 (Monitoring 20

29 6 (Access Control (Hacking) (Denial of Service attack) (Denial of Service AttackDOS) 1TCP SYN Flooding (Source IP) (Server) (TCP SYN) 21

30 SYN+ACK (ACK) TCP (Three-Way Handshake) 2.9 ACK SYN 2.9TCP SYN 2 (Distributed Denial of Service, DDoS) DoS 2.10 DoS Agent (DoS Agent) 3UDP Flood DoS UDP 22

31 (connectionless) UDP (port) 7(Echo service ) DDoS 4ICMP DoS ICMP ICMP ICMP Ping of Death Ping Ping of Death TCP/IP Ping TCP/IP 65,536 Bytes) (Buffer Overflow attack) 23

32 System bug and hole Snort http 24

33 HTTP (Unicode) ASCII ASCII 7 IIS %c1%1c %c0%2f + (Double encod URL "/" %255 %255 %5 "/" IIS (flip slas (IIS) \ / "\" "/" (Full whitespace) Apache (tab) (space) (5) (Internal alert HTTP CONNECT DELETE, GET, HEAD, OPTIONS, POST, PUT, TRACE HTTP 10 HTTP Malicious Code 25

34 (Virus) (Worm) (Trojan horse (Mellisa) Word Normal.dot Outlook ExploreZip 2001 (Code Red) (Hacker) (IIS Server (Nimda) (1) IIS HTMHTMLASP JavaScript readme.eml (2).eml 26

35 Outlook readme.eml local cookie data (Trojan Horse) JavaJavaScript Activex (format) HTML Java AppletJavaScript

36 2.11 [15] (port) (client programs) FTP FTP 28

37 .exe.dll 29

38 (log file) ( Snort) IP URL Snort Proxy_filter Snort URL 30

39 (Layer 4) http URL URL 3.1 IDS 31

40 3.2 URL 32

41 Snort http URL spo_proxy_filter URL Proxy URL Reject (Rule set) Web Client (Rule Subset web-client.rule multimedia.rulesporn.rules proxy_filter alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"web-client readme.eml autoload attempt"; flow:to_client,established; content:"window.open(\"readme.eml\""; nocase; classtype:attempted-user; sid:1290; reference:url, rev:8;) proxy_filter alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"web-client readme.eml autoload attempt"; flow:to_client,established; content:"window.open(\"readme.eml\""; nocase; classtype:attempted-user; sid:1290; reference:url, rev:8; proxy_filter;) 33

42 (web client attacks) proxy_filter Snort Snort (preprocessor) (Detection Engine) spp_http_decode. URL snort (plug-ins) spo_proxy_filter URL spo_proxy_filter 1 ProxyFilterSetup( ) snort plugbase.c InitOutputPlugins( ) snort (Rule Option) proxy_filter 2ProxyFilterInit( snort 3ProxyFilterOptionInit( 4ProxyFilter( URL 34

44 TANet (Gigabit/Fast Ethernet) TANet 爲 URL 4.1 URL service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no service=no cache=no 36

45 1 (IDS Server CPUIntel Pentium III G Bytes 100Mbps Linux Fedora core 1 Mysql Apache PHP Adodb 3.30 Acid 0.96b23 JPGraph LibPcap Snort (modified) 2 (Proxy Server CPUIntel Pentium IV 2.0G 40G Bytes 100Mbps Linux Fedora core 1 Mysql Apache Squid 2.5 stable 5 3 (Client) CPUIntel Pentium IV 1.6G Intel Pentium III 850 Windows XP 37

46 snort URL 4.2 snort URL URL URL 38

47 URL URL 4.3 snort URL 4.3 snort URL URL URL ( 4.1) 50 39

48 (Proxy log file [18] URL filter % 26% 27 73% 27% % 90% 15 75% 25% % 70% 34 68% 32% % 100% % 0% 8 0 0% 100% 8 100% 0% % 0 0 0% % 17% URL 26%URL rule base 40

49 ( 4.4 ) Symantec AntiVirus /4/26 rev.23 8 JavaScript VB Script script IE jav JavaScript Nimda java HTML JavaScript window.open readme.eml 4.5 S 4.5 JS.Exception.Exploit S S S S JS.Nimda S S S S VBS.zulu.A S S S S VBS.FreeLink.B S S S S JS.Trojan.WindowBomb S S S S VBS.happytime.A@mm S S S S VBS.LoveLetter.C(1) S S S S Nimda S S S S 41

50 ( )

51 (1) (2) (3) (4) (open source) (1) URL (2) (Misuse Detection) (Anomaly Detection) API Windows API (3) ( ) outlook 43

52 44

53 [1] Dai Kashiwa, Eric Y. Chen, Hitoshi Fuji, Shuichi Machida, Hiroshi Shigeno, Ken-ichi Okada, and Yutaka Matsushita, Active Countermeasure Platform against DDoS Attacks, IEICE TRANS. INF. & SYST., Vol. E85-D, No. 12, pp , Dec [2] A. Sundaram, An Introduction to Intrusion Detection, URL: [3] Emilie Lundin, and Erland Jonsson, Anomaly-Based Intrusion Detection: Privacy Concerns and Other Problems, Proceedings of the Computer Networks, Vol 34, No.5, pp , Aug [4] Robert F. Erbacher, Kenneth L. Walker, and Deborah A. Frincke, Intrusion and Misuse Detection in Large-Scale Systems, IEEE Transactions on systems, Vol 27, No.3, pp , Feb [5] Tripwire, URL: [6] Intrusion Detection System & Network Attack, URL: [7] M. Iguchi and S. Goto, Detection Malicious Activities through Port Profiling, IEICE Transactions on Information and Sytems, Vol.E82-D, No.4, pp , Apr [8] Susan C. Lee and David V. Heinbuch, Training a Neural-Network Based Intrusion Detector to Recognize Novel Attacks, IEEE Transaction on systems, man, and cybernetics part A: Systems And Humans, Vol. 31, No. 4, pp , Jul

54 [9] Robert K. Cuningham, Richard P. Lippmann, and Seth E. Webster, Detecting and Displaying Novel Computer Attacks with Macroscope, IEEE Transactions on Systems, Vol. 27, No. 4, pp , Jul [10] The Open Source Network Intrusion Detection System URL: [11] Marina Bykova, Shawn Ostermann, and Brett Tjaden, Detection Network Intrusion Via a Statistical Analysis of Network Packet Characteristics, IEEE Transactions on Network Security, Vol.1, pp , Jun [12] Jay Beale, James C. Foster, Jeffrey Posluns, and Brain Caswell, Snort 2.0 Intrusion Detection. US: Syngress Publishing Inc, [13] 2002 [14] The Open Source light-weight Network Intrusion Detection System URL: [15] 2001 [16] Ming-Zuo Chen, Intrusion Detection System Base on Hierarchical Rules, Master Thesis, Department of Information Engineering and Computer Science, Feng Chia University, [17] Ren-Jye Lin Intrusion Detection Using Dynamic Sorting, Master Thesis, Department of Information Engineering and Computer Science, Feng Chia University, [18], URL: 46

<4D6963726F736F667420506F776572506F696E74202D2030325FC2B2B3F85FA44AAB49B0BBB4FABB50B977A8BEA874B2CEC2B2A4B6BB50C0B3A5CE2E707074>

<4D6963726F736F667420506F776572506F696E74202D2030325FC2B2B3F85FA44AAB49B0BBB4FABB50B977A8BEA874B2CEC2B2A4B6BB50C0B3A5CE2E707074> 入侵偵測與預防系統簡介與應用蕭翔之講師 BS 7799 LA 課程大綱第一章認識入侵偵測與預防系統第二章入侵偵測與預防系統的功能分類偵測技術第三章入侵偵測與預防系統部署架構第四章入侵偵測與預防系統的應用效益第五章結