Detecção de ataques de negativa de serviço por meio de fluxos de dados e sistemas inteligentes
Resumo
Este artigo apresenta um novo modelo de detecção de anomalias e tentativas de intrusão baseado na utilização de fluxos de dados (padrão Netflow) e na capacidade classificatória das redes neurais. O modelo caracteriza-se pela detecção baseada no comportamento do ambiente de rede juntamente com a capacidade de absorção de conhecimento dos sistemas inteligentes. Um novo conceito de assinatura é utilizado, sendo testados diversos modelos ao longo da evolução do sistema. Ataques como DoS, DDoS e atividades de worms são rapidamente detectados, de forma automatizada e escalável para ambientes de médio e grande porte, caracterizando um efetivo modelo de monitor para redes conectadas à Internet.Referências
Abad, C.; LI, Y.; Lakkaraju, K.; Yin, X.; Yurcik, W. Correlation Between NetFlow System and Network Views for Intrusion Detection, In Workshop on Link Analysis, Counter-terrorism, and Privacy held in conjunction with the SIAM International Conference on Data Mining (ICDM), 2004.
Allen, Julia H. The CERT Guide to System and Network Security Practices. The SEI Series in Software Engineering. Addison Wesley Professional, 2001, ISBN-10: 0-201-73723-X; ISBN-13: 978-0-201-73723-3.
Bonifacio Jr., J. M., Moreira, E. S., Cansian, Adriano Mauro e Carvalho, A. C. P. L. F. An Adaptive Intrusion Detection System Using Neural Networks. In: Proceedings of the 14th Int. Information Security Conference (IFIP/Sec’98, part of the 15th IFIP World Computer Congress), 31 Aug - 4 Sep, 1998, Vienna, Budapest e Austria, Hungary (joint conference), 1998. IFIP, Austrian Computer Society.
Cansian, A. M.; Silva, A. R. A. da; Souza, M. de. An attack signature model to computer security intrusion detection. Milcom 2002: Proceedings, v. 2, p.1368-1373, 07-10 out. 2002.
CERT.br. Incidentes Reportados ao Cert.br - Janeiro a Dezembro de 2006. Disponível em: http://www.cert.br/stats/incidentes/2006-jan-dec/tipos-ataque.html.
CERT.br - Cartilha de Segurança para Internet, versão 3.1. São Paulo: Comitê Gestor da Internet no Brasil, 2006.
Claise, B. RFC 3954: Cisco Systems NetFlow Services Export Version 9. Published by Internet Engineering Task Force (IETF). Internet Society (ISOC) RFC Editor. USA. oct. 2004. Disponível em: http://www.ietf.org/rfc/rfc3954.txt. Acessado em: 11 dez. 2006.
Fullmer, M. Flow-caputre: Manage storage of flow file archives by expiring old data. Disponível em: http://www.splintered.net/sw/flow-tools/docs/flow-capture.html. Acessado em: 11 dez. 2006.
Fullmer, M. Flow-tools Description. Disponível em: http://www.splintered.net/sw/flow-tools/docs/flow-tools.html. Acessado em: 17 ago. 2006.
Geer, D. Behavior-based network security goes mainstream. In: IEEE Computer, v.39, n.3, pp. 14-17, 2006.
Gil, T. M. NSTX: IP-over-DNS. Disponível em: http://thomer.com/howtos/nstx.html. Acessado em: 11 dez. 2006.
Goyal, V. et al. CompChall: Addressing Password Guessing Attacks. International Conference on Information Technology: Coding and Computing (ITCC), 2005. v1, n.1, p.739-744, april 2005.
Jung, J.; Krishnamurthy, B.; Rabinovich, M. Flash Crowds and Denial of Service Attacks. Proceedings of WWW-2002, Hawaii, v.1, p.293-304, May 2002.
Virus Profile: W95/Kuang.gen Trojan. Disponível em: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=10213. Acessado em: 11 dez. 2006.
Longstaff, I. D., Cross, J. F. A pattern recognition approach to understanding the multi-layer perceptron. Pattern Recogn. Lett. 5, 5 (May. 1987), 315-319.
Manoj Parameswaran, Xia Zhao, Andrew B. Whinston, Fang Fang, "Reengineering the Internet for Better Security," Computer, vol. 40, no. 1, pp. 40-44, Jan., 2007.
Mukherjee, B., Heberlein, L. and Levitt, K. Network Intrusion Detection, IEEE Network, vol. 8, pp. 26-41, May/June 1994.
Quittek, J. et al. RFC 3917: Requirements for IP Flow Information Export: IPFIX. 2004. Published by Internet Engineering Task Force (IETF). Internet Society (ISOC) RFC Editor, USA, oct. 2004.
Rosenblatt, F. The perceptron: A probabilistic model for information storage and organization in the brain. Psychol. Rev., 65:386-408, 1958.
Rosenblatt, F. Principles of Neurodynamics: Perceptrons and the theory of brain mechanisms. Spartan Books, New York, 1962.
University of Stuttgart. SNNS - Stuttgart Neural Network Simulator. Disponível em http://www-ra.informatik.uni-tuebingen.de/SNNS/. Acessado em: 23 jul. 2007.
Wilkinson, T. S.; Mighell, D. A.; Goodman, J. W. Backpropagation and its application to handwritten signature verification. In Book: Advances in neural information processing systems 1, Morgan Kaufmann Publishers Inc. San Francisco, CA, USA, 1989.
Allen, Julia H. The CERT Guide to System and Network Security Practices. The SEI Series in Software Engineering. Addison Wesley Professional, 2001, ISBN-10: 0-201-73723-X; ISBN-13: 978-0-201-73723-3.
Bonifacio Jr., J. M., Moreira, E. S., Cansian, Adriano Mauro e Carvalho, A. C. P. L. F. An Adaptive Intrusion Detection System Using Neural Networks. In: Proceedings of the 14th Int. Information Security Conference (IFIP/Sec’98, part of the 15th IFIP World Computer Congress), 31 Aug - 4 Sep, 1998, Vienna, Budapest e Austria, Hungary (joint conference), 1998. IFIP, Austrian Computer Society.
Cansian, A. M.; Silva, A. R. A. da; Souza, M. de. An attack signature model to computer security intrusion detection. Milcom 2002: Proceedings, v. 2, p.1368-1373, 07-10 out. 2002.
CERT.br. Incidentes Reportados ao Cert.br - Janeiro a Dezembro de 2006. Disponível em: http://www.cert.br/stats/incidentes/2006-jan-dec/tipos-ataque.html.
CERT.br - Cartilha de Segurança para Internet, versão 3.1. São Paulo: Comitê Gestor da Internet no Brasil, 2006.
Claise, B. RFC 3954: Cisco Systems NetFlow Services Export Version 9. Published by Internet Engineering Task Force (IETF). Internet Society (ISOC) RFC Editor. USA. oct. 2004. Disponível em: http://www.ietf.org/rfc/rfc3954.txt. Acessado em: 11 dez. 2006.
Fullmer, M. Flow-caputre: Manage storage of flow file archives by expiring old data. Disponível em: http://www.splintered.net/sw/flow-tools/docs/flow-capture.html. Acessado em: 11 dez. 2006.
Fullmer, M. Flow-tools Description. Disponível em: http://www.splintered.net/sw/flow-tools/docs/flow-tools.html. Acessado em: 17 ago. 2006.
Geer, D. Behavior-based network security goes mainstream. In: IEEE Computer, v.39, n.3, pp. 14-17, 2006.
Gil, T. M. NSTX: IP-over-DNS. Disponível em: http://thomer.com/howtos/nstx.html. Acessado em: 11 dez. 2006.
Goyal, V. et al. CompChall: Addressing Password Guessing Attacks. International Conference on Information Technology: Coding and Computing (ITCC), 2005. v1, n.1, p.739-744, april 2005.
Jung, J.; Krishnamurthy, B.; Rabinovich, M. Flash Crowds and Denial of Service Attacks. Proceedings of WWW-2002, Hawaii, v.1, p.293-304, May 2002.
Virus Profile: W95/Kuang.gen Trojan. Disponível em: http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=10213. Acessado em: 11 dez. 2006.
Longstaff, I. D., Cross, J. F. A pattern recognition approach to understanding the multi-layer perceptron. Pattern Recogn. Lett. 5, 5 (May. 1987), 315-319.
Manoj Parameswaran, Xia Zhao, Andrew B. Whinston, Fang Fang, "Reengineering the Internet for Better Security," Computer, vol. 40, no. 1, pp. 40-44, Jan., 2007.
Mukherjee, B., Heberlein, L. and Levitt, K. Network Intrusion Detection, IEEE Network, vol. 8, pp. 26-41, May/June 1994.
Quittek, J. et al. RFC 3917: Requirements for IP Flow Information Export: IPFIX. 2004. Published by Internet Engineering Task Force (IETF). Internet Society (ISOC) RFC Editor, USA, oct. 2004.
Rosenblatt, F. The perceptron: A probabilistic model for information storage and organization in the brain. Psychol. Rev., 65:386-408, 1958.
Rosenblatt, F. Principles of Neurodynamics: Perceptrons and the theory of brain mechanisms. Spartan Books, New York, 1962.
University of Stuttgart. SNNS - Stuttgart Neural Network Simulator. Disponível em http://www-ra.informatik.uni-tuebingen.de/SNNS/. Acessado em: 23 jul. 2007.
Wilkinson, T. S.; Mighell, D. A.; Goodman, J. W. Backpropagation and its application to handwritten signature verification. In Book: Advances in neural information processing systems 1, Morgan Kaufmann Publishers Inc. San Francisco, CA, USA, 1989.
Publicado
27/08/2007
Como Citar
CANSIAN, Adriano M.; CORRÊA, Jorge L..
Detecção de ataques de negativa de serviço por meio de fluxos de dados e sistemas inteligentes. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 7. , 2007, Rio de Janeiro.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2007
.
p. 38-54.
DOI: https://doi.org/10.5753/sbseg.2007.20916.
