DDo S Do SDDo S SYN flooding ping

攻擊方式簡介(DDo. S) • Do. S/DDo. S – 資源耗竭 • SYN flooding • ping flooding – 頻寬消耗 • ICMP Broadcast • UDP Broadcast

攻擊方式簡介(R 2 L) • Remote File Access (R 2 L) – 運用服務(Service)的弱點 – 存取系統安全相關檔案或使用者密碼檔 – 例如: 某機器開啟IIS web service http: //target/scripts/. . %c 1. . %lc. . /winnt/system 3 2/cmd. exe? /c+dir

入侵偵測系統的偵測效能 • 偵測分析方法選取 1. 有限狀態機 2. 統計分析 3. 類神經網路 4. 貝氏網路 5. 模糊理論 (Finite State Machine) (Statistical Analysis) (Neural Network) (Bayesian Network) (Fuzzy Theory)

偵測分析方法(BN) • 貝氏分析方法實作舉例(SYN Flooding) TCP Pakcet (Relation) SYN Flooder SYN SIP ACK DIP

偵測分析方法(BN) • If Pm(tcp) > 0. 91 && V(R) > 1 && Vm(syn) >1. 15 Vm(syn+ack) > 1. 15 && Vm(sip) > 80 && Vm(dip) > 80 then SYN Flooder happen

偵測分析方法(FT) • 模糊理論(Fuzzy Theory) A local network Network Data Collector (NDC) Raw data Network Data Processor (NDP) Mined data Fuzzy Input Fuzzy Threat Analyzer (FTA) Network Data Collector (NDC) Raw data A local network Fuzzy Alerts Fuzzy Input Network Data Processor (NDP) Mined data

偵測分析方法(FT) • Fuzzy Inputs： • COUNT， UIQUENESS，VARIANCE

偵測分析方法(FT) • Example Rules： If (COUNT of SDPs == MEDIUM) AND (UNIQUENESS of SDPs Observed == HIGH) THEN “Port Scan” == HIGH

Reference • 李駿偉, 入侵偵測系統分析方法效能之定量評估, 私立中原大學資訊 程研究 所碩士之學位論文 • An Eye on Network Intruder-Administrator Shootouts Luc Girardin, UBS, Ubilab • J. E. Dickerson, J. A. Dickerson, "Fuzzy Network Profiling for Intrusion Detection. " Proceedings of NAFIPS 19 th International Conference of the North American Fuzzy Information Processing Society, Atlanta, July, 301306, 2000.