A Research of Using Multi-Information to Develop Intrusion Detection Systems

• Main Authors: Chia-Hsien Lin, 林佳憲
• Other Authors: Dwen-Ren Tsai
• Format: Others
• Language: zh-TW
• Published: 2009
• Online Access: http://ndltd.ncl.edu.tw/handle/83029796983393256572

碩士 === 中國文化大學 === 資訊管理研究所 === 97 === This Intrusion attack and worm are a major threat to the security of today’s network and cause significant worldwide disruptions, a huge number of infected hosts generating overwhelming traffic will impact the performance of network. The typical solution, combined with the common practice of using Firewall and Intrusion Detection System in the network. The traditional IDSs detect attack via capturing network packet and signature which is a pattern that we want to look for in traffic. In good security practice, a collection of these signatures must be constantly updated to mitigate emerging threats. Outdated signature databases can leave the IDS vulnerable to Zero-Day attack and generate amount of false positive and false negative situation. This leads to research which are better at detecting some attacks than others, and so to the use of multiple different types of information within a network to develop IDS. In this paper, we propose three different information which is netflow, alerts of signature base IDS and host’s vulnerability and require sophisticated management of heterogenous alerts from multiple sources. This management should enable correlation of alerts with the goal of better detecting attacks, and reducing the monitoring workload on administrators. This thesis presents an architecture utilizing commodity components and the Intrusion Detection Message Exchange Format (IDMEF) to enable this type of alert management. We also implement a prototype system to approve the multi-information IDS which can help network administrators to monitor suspect attack activities in their managed networks. Our evaluation of the prototype system on testing network environment validates that it achieves pretty low false positive and negative rate and good detecting rate.