Sistema de Detecção de Backdoors e Canais Dissimulados
Resumo
Este artigo apresenta os conceitos de backdoors e canais dissimulados, alguns exemplos de ferramentas disponíveis publicamente e uma metodologia para detectá-los. O sistema de detecção de intrusão apresentado é um sistema híbrido, que utiliza mapas auto-organizáveis como técnica de detecção por anomalia e reconhecimento de padrões como técnica de detecção por abuso. O sistema tem como objetivo contribuir com toda comunidade de administração e segurança de redes, utilizando-se das vantagens das estratégias de detecção.
Referências
Anderson, J. P. (1980). Computer security threat monitoring and surveillance. Technical Report, James P. Anderson Co. [link].
Barbara, D., Couto, J., Jajodia, S., Popyack, L., and Wu, N. (2001). Adam: Detecting intrusions by data mining. In IEEE Workshop on Information Assurance and Security. [link].
Braga, A. P., Carvalho, A. C. P. L. F., and Ludemir, T. B. (2002). Redes Neurais Artificiais Teoria e Aplicações. LTC, 1 edition.
Brinkhoff, L. (2004). Httptunnel. NoCrew.org. http://www.nocrew.org/software/httptunnel.html.
Castro, S. (2003a). Cctt - Covert Channel Tunneling Tool. Gray World.net Team. http://www.gray-world.net/pr_cctt.shtml.
Castro, S. (2003b). Covert Channel and Tunneling over the HTTP protocol Detection:
GW implementation theoretical design. Gray World.net Team. [link].
Chaves, C. H. P. C. (2003). Ferramenta de visualização gráfica do tráfego em redes tcp/ip - trafficshow. Relatório técnico 04/2003, Universidade Federal de Ouro Preto, Departamento de Computação.
Chaves, C. H. P. C. and Montes, A. (2004). Backdoors e Canais Dissimulados: uma metodologia para detecção. In Anais do VI Simpósio sobre Segurança em Informática (SSI'2004), São José dos Campos, SP.
Chaves, M. H. P. C. (2002). Análise de estado de tráfego de redes tcp/ip para aplicação em detecção de intrusão. Dissertação de mestrado, Instituto Nacional de Pesquisas Espaciais, Laboratório Associado de Computação e Matemática Aplicada LAC. daemon9 (1997). LOKI2 (the implementation). Phrack Inc., 51(06). http://www.phrack.org/show.php?p=51\&a=6.
daemon9 and alhambra (1996). Project Loki. Phrack Inc., 49(06). http://www.phrack.org/show.php?p=49\&a=6.
Dokas, P., Ertoz, L., Kumar, V., Lazarevic, A., Srivastava, J., and Tan, P. N. (2002).
Data mining for network intrusion detection. In NSF Workshop on Next Generation
Data Mining. [link].
Dyatlov, A. (2003). Firepass. Gray World.net Team. [link].
Dyatlov, A. and Castro, S. (2003). Wsh - Web Shell. Gray World.net Team. http://www.gray-world.net/pr_wsh.shtml.
Ertoz, L., Eilertson, E., Lazarevic, A., Tan, P. N., Dokas, P., Kumar, V., and Srivastava, J. (2003). Detection and summarization of novel network attacks using data mining. Technical report, University of Minnesota, Computer Science Departament. http://www-users.cs.umn.edu/~aleks/MINDS/papers/raid03.pdf.
Farrow, R. (2004). Musings. ;login: The Usenix Magazine, 29(08).
Hauser, V. (1999). Placing Backdoors Through Firewalls. The Hacker's Choice. http://www.thc.org/download.php?t=p&d=fw-backd.htm.
Hauser, V. (2002). The Reverse WWW Shell. The Hacker's Choice. http://www.thc.org/download.php?t=r&d=rwwwshell-2.0.pl.gz.
Jacobson, V., Leres, C., and McCanne, S. (2004). Tcpdump. TCPDUMP public repository. http://www.tcpdump.org/release/tcpdump-3.8.3.tar.gz.
Kohonen, T. (1989). Self-Organizing and Associative Memory. Springer-Verlag, 3 edition.
Lampson, B. W. (1973). A note on the confinement problem. Communications of the ACM, 16(10):613-615.
Lee, W. and Stolfo, S. (1998). Data mining approaches for intrusion detection. In Proceedings of the 7th USENIX Security Symposium. http://citeseer.ist.psu.edu/article/lee98data.html.
Mudge (2003). Insider threat. ;login: The Usenix Magazine, 28(06).
Pack, D. J., Streilein, W., Webster, S., and Cunningham, R. (2002). Detecting HTTP Tunneling Activities. In In Proceedings of the 2002 IEEE Workshop on Information Assurance. http://www.ll.mit.edu/IST/pubs/Pack-IEEE2002.pdf.
Portnoy, L., Eskin, E., and Stolfo, S. (2001). Intrusion detection with unlabeled data using clustering. In ACMWorkshop on Data Mining Applied to Security (DMSA 2001). http://citeseer.ist.psu.edu/article/portnoy01intrusion.html.
Ramadas, M., Ostermann, S., and Tjaden, B. C. (2003). Detecting anomalous network
traffic with self-organizing maps. In RAID. http://www.cs.fit.edu/~pkc/id/related/ramadas03raid.ps.gz.
Rhodes, B. C., Mahaffey, J. A., and Cannady, J. D. (2000). Multiple self-organizing maps for intrusion detection. In Proceedings of the 23rd National Information Systems Security Conference. [link].
Sundaram, A. (2000). An introduction to intrusion detection. [link].
U.S. Department of Defense (1985). Trusted Computer System Evaluation. In The Orange Book, Washington, DC, USA. [link].
Ye, N., Li, X., Chen, Q., Emran, S. M., and Xu, M. (2001). Probabilistic techniques for intrusion detection based on computer audit data. IEEE Transactions on Systems, Man, and Cybernetics, 31(4).
Zhang, Y. and Paxon, V. (2000). Detecting Backdoors. In Proceedings of the 9th Usenix Security Symposium. [link].
Barbara, D., Couto, J., Jajodia, S., Popyack, L., and Wu, N. (2001). Adam: Detecting intrusions by data mining. In IEEE Workshop on Information Assurance and Security. [link].
Braga, A. P., Carvalho, A. C. P. L. F., and Ludemir, T. B. (2002). Redes Neurais Artificiais Teoria e Aplicações. LTC, 1 edition.
Brinkhoff, L. (2004). Httptunnel. NoCrew.org. http://www.nocrew.org/software/httptunnel.html.
Castro, S. (2003a). Cctt - Covert Channel Tunneling Tool. Gray World.net Team. http://www.gray-world.net/pr_cctt.shtml.
Castro, S. (2003b). Covert Channel and Tunneling over the HTTP protocol Detection:
GW implementation theoretical design. Gray World.net Team. [link].
Chaves, C. H. P. C. (2003). Ferramenta de visualização gráfica do tráfego em redes tcp/ip - trafficshow. Relatório técnico 04/2003, Universidade Federal de Ouro Preto, Departamento de Computação.
Chaves, C. H. P. C. and Montes, A. (2004). Backdoors e Canais Dissimulados: uma metodologia para detecção. In Anais do VI Simpósio sobre Segurança em Informática (SSI'2004), São José dos Campos, SP.
Chaves, M. H. P. C. (2002). Análise de estado de tráfego de redes tcp/ip para aplicação em detecção de intrusão. Dissertação de mestrado, Instituto Nacional de Pesquisas Espaciais, Laboratório Associado de Computação e Matemática Aplicada LAC. daemon9 (1997). LOKI2 (the implementation). Phrack Inc., 51(06). http://www.phrack.org/show.php?p=51\&a=6.
daemon9 and alhambra (1996). Project Loki. Phrack Inc., 49(06). http://www.phrack.org/show.php?p=49\&a=6.
Dokas, P., Ertoz, L., Kumar, V., Lazarevic, A., Srivastava, J., and Tan, P. N. (2002).
Data mining for network intrusion detection. In NSF Workshop on Next Generation
Data Mining. [link].
Dyatlov, A. (2003). Firepass. Gray World.net Team. [link].
Dyatlov, A. and Castro, S. (2003). Wsh - Web Shell. Gray World.net Team. http://www.gray-world.net/pr_wsh.shtml.
Ertoz, L., Eilertson, E., Lazarevic, A., Tan, P. N., Dokas, P., Kumar, V., and Srivastava, J. (2003). Detection and summarization of novel network attacks using data mining. Technical report, University of Minnesota, Computer Science Departament. http://www-users.cs.umn.edu/~aleks/MINDS/papers/raid03.pdf.
Farrow, R. (2004). Musings. ;login: The Usenix Magazine, 29(08).
Hauser, V. (1999). Placing Backdoors Through Firewalls. The Hacker's Choice. http://www.thc.org/download.php?t=p&d=fw-backd.htm.
Hauser, V. (2002). The Reverse WWW Shell. The Hacker's Choice. http://www.thc.org/download.php?t=r&d=rwwwshell-2.0.pl.gz.
Jacobson, V., Leres, C., and McCanne, S. (2004). Tcpdump. TCPDUMP public repository. http://www.tcpdump.org/release/tcpdump-3.8.3.tar.gz.
Kohonen, T. (1989). Self-Organizing and Associative Memory. Springer-Verlag, 3 edition.
Lampson, B. W. (1973). A note on the confinement problem. Communications of the ACM, 16(10):613-615.
Lee, W. and Stolfo, S. (1998). Data mining approaches for intrusion detection. In Proceedings of the 7th USENIX Security Symposium. http://citeseer.ist.psu.edu/article/lee98data.html.
Mudge (2003). Insider threat. ;login: The Usenix Magazine, 28(06).
Pack, D. J., Streilein, W., Webster, S., and Cunningham, R. (2002). Detecting HTTP Tunneling Activities. In In Proceedings of the 2002 IEEE Workshop on Information Assurance. http://www.ll.mit.edu/IST/pubs/Pack-IEEE2002.pdf.
Portnoy, L., Eskin, E., and Stolfo, S. (2001). Intrusion detection with unlabeled data using clustering. In ACMWorkshop on Data Mining Applied to Security (DMSA 2001). http://citeseer.ist.psu.edu/article/portnoy01intrusion.html.
Ramadas, M., Ostermann, S., and Tjaden, B. C. (2003). Detecting anomalous network
traffic with self-organizing maps. In RAID. http://www.cs.fit.edu/~pkc/id/related/ramadas03raid.ps.gz.
Rhodes, B. C., Mahaffey, J. A., and Cannady, J. D. (2000). Multiple self-organizing maps for intrusion detection. In Proceedings of the 23rd National Information Systems Security Conference. [link].
Sundaram, A. (2000). An introduction to intrusion detection. [link].
U.S. Department of Defense (1985). Trusted Computer System Evaluation. In The Orange Book, Washington, DC, USA. [link].
Ye, N., Li, X., Chen, Q., Emran, S. M., and Xu, M. (2001). Probabilistic techniques for intrusion detection based on computer audit data. IEEE Transactions on Systems, Man, and Cybernetics, 31(4).
Zhang, Y. and Paxon, V. (2000). Detecting Backdoors. In Proceedings of the 9th Usenix Security Symposium. [link].
Publicado
26/09/2005
Como Citar
CHAVES, Carlos Henrique P. C.; MONTES, Antonio.
Sistema de Detecção de Backdoors e Canais Dissimulados. In: SIMPÓSIO BRASILEIRO DE SEGURANÇA DA INFORMAÇÃO E DE SISTEMAS COMPUTACIONAIS (SBSEG), 5. , 2005, Florianópolis.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2005
.
p. 311-324.
DOI: https://doi.org/10.5753/sbseg.2005.21539.
