以Netflow為基礎之網路流量分析系統

Size: px

Start display at page:

Download "以Netflow為基礎之網路流量分析系統"

稚赈税
5 years ago
Views:

1 Netflow 路流量 A Netflow-Based Network Traffic Analysis System 劉 Yi-Chun Lai Hao-Wei Liou Chih-Hau Huang 林 Ya-Chi Lin Ching-Chuan Chiang Hung-Ming Tzuu Department of Computer and Communication Engineering, Ming Chuan University 路來路來路路路都來路異路理路料異料數量路流量更惡更易異路來路異行路路異異路離路不理路不路來路異不路不路不路論路 NetFlow 離路流量路流量異路 Netflow 異流量路 Abstract Network security is playing a very important role in current Internet environment. The investments in developing network applications and services are tremendous and increasing. Network security becomes a very significant issue because without secure and safe network mechanism all investments would become worthless. Most network security systems, such as firewalls and intrusion detection systems, adopt online and centralized analysis methods to

2 detect and protect network systems. Online packet analytic schemes directly capture, decode, examine and filter packets, thus incurring process overhead and transmission delay. The situation is deteriorated when network traffic increases in a large amount and thus becomes the networking bottleneck and degrades the transmission performance. Centralized secure mechanism only analyzes local information not suitable for current diversity of network attacking. In this paper we develop an offline-based network analysis system using netflow s logs to detect abnormal traffic in network activities. Keywords: Netflow, Network Security, Intrusion Detection

3 1. 年來路拓路數不路來惡路降路度路路惡都料路了路路例路 [24] 路濾路 [23] 都 Online 路路異精異路 CPU Memory 料數量不易易路離 Offline-based 路例流量 [1][18][22][25][26][27] 不路不路不路不來量降率理不易路易路連離異立不不利度路利量異連來路連路路 NetFlow[12] 路流量異路離 NetFlow 路流量路來數路流量不路流量異連度降不便浪路不勞勞 - 離 NetFlow 路流量利路路路 NetFlow 行流量數路流量異異立異路理路理路

4 2. 離路類 Cisco Netflow [12][20] Cisco 路流量 Cisco IP 流量理理路狀理路連 IP cache 路理路 NetFlow 路路來流量料流量 Flow NetFlow Flow 兩連流說路連都錄兩 Flow 料錄連錄連路錄 flow flow 料裡不 flow 錄 flow 錄來量 UDP Netflow 不 Netflow Version 5 Cisco 路例利 logging 令路路利 NetFlow 來路路路路連路 Node 路都路路來了路狀來路路路量都 NetFlow 離 NetFlow 路 Header UDP net flow NetFlow Collector ; Netflow 路不 netflow pdu 了 source ip destination ip source port destination port protocol size 48 Bytes NetFlow UDP 24 Netflow PDU 說 Netflow UDP 便錄了 24 路離路 NetFlow 都路料利 NetFlow 立料行來路異離來料路異 3. 流 3.1 路 (Cisco 3750) 路 (Cisco 6509) Netflow 流量料 Cisco 3750 不 NetFlow

Cisco 6509 來 NetFlow 料利 IOS 令 Cisco6509 路 Interface NetFlow 利令 ip route-cache flow Cisco 6509 Netflow 料了行 Cisco 3750 router Cisco 3750 Layer 3 Switch 不 Netflow Netflow (PC 129) Switch Port mirror

5 Cisco 6509 來 NetFlow 料利 IOS 令 Cisco6509 路 Interface NetFlow 利令 ip route-cache flow Cisco 6509 Netflow 料了行 Cisco 3750 router Cisco 3750 Layer 3 Switch 不 Netflow Netflow (PC 129) Switch Port mirror Cisco 3750 Cisco 6509 mirror port 了路 Cisco 3750 來來 (pc129) nprobe[21] Netflow nprobe Netflow Loop address Netflow (Netflow collector) C 了 Netflow collector 兩行 (thread) 行路 Port( Port 33433) Netflow 來來列 (queue) 裡行列 Netflow 料來 (FIFO) Flow 切料料 PostgreSQL 料欄料列料 ( 3.1) 不論不 Netflow 都流量參 NetFlow 錄 IP port 流量流量路量流量異裡路流量不路例

路 ( 連 ) 流量 IP port 來 (WEB E-MAIL FTP BBS ) 行都都流量行來流量狀流量路異參例流量流量若流量異便理路路理路路流量來路理來不路 3.

6 路 ( 連 ) 流量 IP port 來 (WEB FTP BBS ) 行都都流量行來流量狀流量路異參例流量流量若流量異便理路路理路路流量來路理來不路 3.3 流 Fedora [28] WEB Server PHP[2][3][4][13][14] PostgreSQL[5][15][16][17] 利 Netflow nprobe 路流量利 C Netflow 料欄 PostgreSQL 料 PHP 聯 PostgreSQL 料料路流量狀異狀路流量異流 Netflow 路流量不論路理不行理行說

7 流量理路流量狀累理更易路流量狀 3.5 流量 3.6 流量 IP 率 /Application 行 IP 率 /Application 行 IP 流量

8 Application 狀流量狀流量行便流量 3.7 IP 率 / Application 行 3.8 IP 率 / Application 行流量 Ajax[9] 數流量了流量數量 - 料 3.9 流量了更便易不不 Table Section 料 Date Search All Day 列 Start Date/End Date IP Search 行 -Application 行 /IP 行 /Protocol 行

9 行行來兩 (radio box)in OUT IN service OUT service 兩 (input box) 來 JavaScript 曆曆 SHOW 欄 1. Application service port 2. Traffic service 料量 Kbps 3. Percentage of all traffic service service 欄 service port IP 行列 service IP 量列來不來了行 Application 行流量異流量歷料流量流量異路流量異料 (Target) 料 (Sample) 切不流量料 (Target) 異流量料料 (Sample) 流量料

Application 行 web service 量利來濾異流量 3.11 3.12 3.

10 不料量數 (packets) 流量 (Mbps) 不料來 (In) (Out) netflow 不不料 (Sample) 數料 (Target) 料 (Sample) 料流量料 (Target) 異流量異流量利例 IP 異量異 IP Application 行 web service 量利來濾異流量異 -IP 量異 IP 量異理量 IP 理流量量流量流量量 IP 流量 (MByte) 量流量理 IP 流量行理異流量 IP 料連 Application 行

11 3.14 IP 量 5. 論路了了不 mail 不度路流量路更漏洞料路理路流量流量異了力路 (Cisco 3750) 路 (Cisco 6509) Netflow 流量料料 Application 行 IP 率行 Protocol 行 IP 量異料理來不 IP 流量量理異 IP IP IP 流量量不流量量異 Rule 理理不不異數異 Rule 不 Rule 若異列流量異都來 6. 參 (References) [1] 林流量路理論 91 年 [2] 廉雷 PHP MySQL 北禮 94 年

12 [3] 倫 PHP : 路北行 95 年 [4] 類 PHP5 北 95 年 [5] 沈 PostgreSQL 北 92 年 [6] 禮 Michael Mahemoff Ajax 北 95 年 [7] 論 [8] Wiki [9] Ajax Jesse James Garrett [10] C [11] Jpgraph [12] Netflow [13] Php [14] PHP [15] PostgreSQL 料 [16] PostgreSQL 7.4devel [17] [18] SNMP [19] TWCERT/CC [20] Wikipedia-Netflow [21] nprobe: [22] Caberera, J.B.D.; Ravichandran, B.; Mehra, R.K Statistical Traffic Modeling for Network Intrusion Detection 1999 IEEE; This paper appears in: Modeling, Analysis and Simulation of Computer and Telecommunication Systems, Proceedings. 8th International Symposium on On page(s): , 29 Aug.-1 Sept [23] H.S. Javitz, and A. Valdes, The NIDES Statistical Component Description and Justification" Technical Report, SRI International, California ' Mar [24] Hari, A.; Suri, S.; Parulkar, G., Detecting and resolving packet filter conflicts, INFOCOM Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE, vol, pp [25] David Marchette. A statistical Method for Profiling Network Traffic.1999 by The USENIX Association. [26] Naonori Otsuka, Hironori Hiraishi, and Fumio Mizoguchi Log summarizing agent for web access data using data mining techniques Joint 9th IFSA World Congress and 20th NAFIPS International Conference,2001. [27] Ramakrishnan Srikant, Yinghui Yang, Mining Web Logs to Improve Website Organization, [28] Fedora:

untitled

untitled 年度行 ~ 利例立易年倫老老 1 錄度利療益 2 論六 3 療切連療切療行料年療年例見療度療度行療不降林療利療年流行尿 4 療女了利度療異更更便利更易例神類林省利量更利尿令 5 隆路拉了離路了降行行療行不理療行療兩不療不 6 列療