用於網路鑑識分析的跨層級狀態化封包採集紀錄之設計與實作

Abstract

近年來網路的日益普及，系統弱點的知識比以往更易於網路中取得，導致網路攻擊事件層出不窮、日新月異，時至今日都還沒有完善的機制可以改善現行的網路安全架構。而既有的signature-based的入侵偵測系統與防火牆等，這些將各個封包獨立檢視的非記憶性(stateless)偵測方式，已經不能及時的阻擋網路蠕蟲(worm)的攻擊。而且當駭客的技術愈來愈容易取得的未來，網路蠕蟲勢必會更加的精密(sophisticated)，而攻擊步驟亦會更加複雜，且將更難用目前非記憶性的方式來偵測。而polymorphic技術亦在網路上愈來愈普遍，未來的網路蠕蟲如果都經過polymorphism之技術改進過，封包內容裡將不再有不變的signature，傳統的入侵偵測系統所採取的非記憶性而將封包視為獨立個體的字串比對方式，將無法偵測出此一攻擊。 我們之前曾提出一個跨層級(cross-layer)狀態化(Stateful)的行為模式(behavior-based)偵測系統Security Monitor (SecMon)，針對網路攻擊在不同層級之protocol layer、service layer、以及attack symptoms都以有限狀態機(FSM)來加以描述其可能攻擊的重要行為。並且採用狀態化檢測(stateful inspection)的方式來完整追蹤網路封包流通的狀態與內容，以及偵測可疑的複雜的攻擊步驟。目的是達到有效即早偵測網路異常狀況。這個方法較 Signature-based的入侵偵測系統更有能力偵測polymorphic網路蠕蟲攻擊以及未知的、新的網路攻擊。本論文主要是根據這個方法設計並實作一套網路封包採集記錄架構來達到有效率地採集、紀錄網路可疑的攻擊事件過程中所有的重要封包流通之證據。以作為事後(post-mortom)網路犯罪鑑識分析之用。根據所採集記錄的資料，再藉由cross-layer stateful SecMon系統完整還原事件的真相。

In today’s world, exploit codes are being created more easily and faster than ever. As a result, more and more attack events are happened on the Internet. Unfortunately, current Internet security architecture can not efficiently control those malicious activities. Traditional intrusion detection systems used stateless approach in which network traffic is inspected packet by packet. Because stateless approaches can not monitor the behavior of the network, they will fail to detect a sequence of complicated attack procedure. In addition, due to more and more exploit programs available in the public domain, attackers are now capable of launching more sophisticated attacks such as stealthy worms. Attack procedure of stealthy worms will become more complicated to evade detection. Furthermore, there are some attacks such as polymorphic worms can mutate themselves and will not have clear signature. The stateless approach with simple pattern-matching techniques is not sufficiently to detect sophisticated attacks and polymorphic worms. In the previous work, we proposed Security Monitor (SecMon), a cross-layer Stateful intrusion detection system, to detect sophisticated attacks. In SecMon, we use finite state machines to maintain the transition of different layer protocols to understand the evolution of connections. SecMon is able to detect polymorphic worms and unknown attacks at early stage which can not be detected by Signature-based intrusion detection system. In this thesis, we proposed a sufficient logging mechanism based on SecMon to sufficiently log malicious activities and preserve the evidence to achieve the goal of post-mortem analysis. With the logging event and the cross-layer stateful SecMon intrusion detection system, the system administrator can reconstruct the attack procedure to understand what happened in the network.