【作者】 陈云芳；

【导师】 王汝传；

【作者基本信息】 苏州大学 ， 计算机应用技术， 2008， 博士

【摘要】 入侵检测系统在计算机网络系统安全中起着关键作用。本文在深入分析了当前入侵检测技术研究现状的基础上,提出并构建了一个完整的基于移动代理的分布式入侵检测系统。该系统具有比传统入侵检测系统更好的检测性能以及具有可靠性、健壮性和自适应性等优点。本文所提出的分布式入侵检测系统关键技术包括一个平台和三个子系统即:基于移动代理的入侵检测平台、基于主机系统调用序列分析的入侵检测子系统、基于主机用户行为关联分析的入侵检测子系统、基于网络数据包免疫分析的入侵检测子系统。本文首先界定了分布式入侵检测系统的基本特征和关键技术要素,然后描述了移动代理平台的基本特性,分析了智能移动代理在分布式入侵检测系统的关键性平台作用。接着提出了一种移动代理的位置透明性方案,该方案有效解决移动代理平台位置管理和消息传递的基础问题。最后提出一种基于移动代理的入侵检测平台,给出系统的体系结构,阐述实现的关键技术,并进行了相关测试。大部分入侵行为都必须通过系统调用来达到它们破坏系统的目的。基于特定程序的系统调用序列具有一定稳定性的原理,本文提出一种系统调用序列分析的系统模型以及详细设计方案。采用将运行于核心态的调用信息拷贝到用户缓冲区中,提取所需的系统调用信息。然后在无入侵的情况下,经过海量的正常的系统调用序列训练得到正常模式库。最后将实时监测到的特定程序的系统调用序列与正常的系统调用模式库进行匹配,采用汉明距离计算出他们的最大相似度,以判定是否出现入侵异常。最后对系统调用序列分析检测模块在移动代理平台下的实现进行了相关测试。有许多入侵行为都是合法用户的非正常操作来达到破坏系统的目的。与系统调用序列分析不同的是,用户行为分析主要涉及到合法用户的非法或误操作模式。基于普通用户的操作行为具有前后的关联性原理,本文提出一种基于用户行为关联分析的系统模型以及详细的设计方案。首先定义了主机合法用户的行为特征和行为模式,采用静态和动态相结合的方式进行用户行为模型的建立,然后根据操作系统日志信息,针对用户的每次登陆会话产生用户行为特征数据,采用递归式相关函数算法来对关联序列进行相似度的计算,以判定是否出现非常行为。最后对用户行为关联分析检测模块在移动代理平台下的实现进行了相关测试。网络数据包分析可以对某个网段的网络数据流进行大规模的分析处理,可以有效监控大规模的计算机网络。由于免疫系统天然的分布性,非常契合入侵检测系统的需求。本文提出一种移动代理平台下的网络数据包免疫分析系统模型以及详细的设计方案。采用最简单的二进制方式表达网络数据包的自我特征;特征之间的距离采用欧拉距离的计算方式;检测器的初始产生采用简单的r连续匹配穷举法,各个检测子节点均可以自主产生属于自己的检测器集合;设置一个总体检测集合库,用于存放源自于各个检测节点所带来的经过初选的检测集,并通过基于克隆选择的二次精英机制产生后代种群。经过各个节点的自体首次免疫耐受,再经过总检测库基于克隆选择的二次精英机制搜索产生优化种群,可以使得系统的各个节点和总控节点都在不断的进化当中,使得检测器所产生的无效检测漏洞概率大大降低。最后自主设计并实现了一个基于移动代理的分布式入侵检测系统原型系统,实验表明移动代理的平台完全能够作为分布式入侵检测系统的可靠的、安全的平台,运行其上的系统调用序列分析、用户行为关联分析、网络数据包免疫分析完全能够达到了预期目标。更多还原

【Abstract】 Intrusion Detection System plays a key role in the domain of computer network security. Based on in-depth analysis of the current intrusion detection technologies, the paper proposed and established a complete Distributed Intrusion Detection System based on the mobile agent platform. The system has better detection performance with reliability, robustness and adaptability, and other advantages as well as traditional intrusion detection systems.The key technologies of Distributed Intrusion Detection System proposed in this paper include one platform and three subsystems. intrusion detection platform based on mobile agent, host intrusion detection subsystem based on sequence analysis of the system calls, host intrusion detection subsystem based on associated analysis of the user behavior and network intrusion detection subsystem based on immune analysis of the network packet.This paper defines the basic characteristics and the key technical elements of Distributed Intrusion Detection System, and then describes the key role of intelligent mobile agent platform in the Distributed Intrusion Detection System platform. Then, a scenario of the mobile agent location transparency is bringed forward, which can effectively solute location management and messaging about foundation problems of mobile agent platform. Finally, a kind of architecture mobile agent-based distributed intrusion detection system, on the key technology platform, and the related tests. Most of the invasion can achieve the purpose of their destruction via system calls.Based on the stability principle of system calls sequence with the specific procedures, this paper presents a system archtitecture as well as a detailed design based on sequence analysis of system call. Firstly, extracting the system calls information by copying the kernel info to the user buffer. Then, normal mode database is built after a flood of the normal system calls sequence training under no-invasion circumstances. Finally, the system calls sequence, which is obtained by the real-time monitoring specific procedures, match the pattern with the normal mode database, calculate their greatest similarity by Hamming Distance to determine whether there has invasion. The realization of intrusion detection subsystem based on sequence analysis of system call in mobile agent platform has been related tests.Many invasions are bringed by illegle operation of legitimate users to achieve the purpose. Different with sequence analysis of system call, user behavior analysis mainly related to legitimate users of illegal or misuse operation mode. Based on the relevance principles between the before and after ordinary operation of user behavior, this paper presents a system archtitecture as well as a detailed design based on correlation analysis of user behavior. Firstly, legitimate user behavioral characteristics and patterns are defined by using a combination of static and dynamic user behavior model. Then, according to the operating system log information, user behavior data is built on user session by each login. Finally, calculate the similarity of correlation sequence by recursive correlation functional algorithm to determine whether there has invasion. The realization of intrusion detection subsystem based on correlation analysis of user behavior in mobile agent platform has been related tests.Network packet analysis can effectively monitor large-scale computer networks by analysis and processing of large-scale networks data-flow. The natural distribution of immune system is suitable for the needs of Distributed Intrusion Detection System. This paper presents a system archtitecture as well as a detailed design based on immune analysis of network packets in mobile agent platform. The self-characteristics of network packet is expressed with most simple binary and the distance between the packet characteristics is expression with Euler distance. The detection set for the initial use come into being by exhaustive method of simple r continuous match. Moreover, various detection sub-nodes can be independently produce their own detector set. It set up a pool for overall detection set for storage sets derived from the various sub-nodes which has filtered, and produce future generations of the elite population based on the secondary mechanism through clonal selection. After all, undergoing immune tolerance of sub-nodes and the clonal selection of overall node based on the secondary elite search mechanisms, the Intrusion Detection System can make all the sub-nodes and overall node in constant evolution. The probability of detecting vulnerabilities invalid greatly reduced.Finally, a Distributed Intrusion Detection prototype system based on mobile agent platform is proposed and implemented. Experiment results show that mobile agent platform is fully capable of Distributed Intrusion Detection System as reliable and secure platforms, and the sequence analysis subsystem based on system call, relational analysis subsystem based on users’behavior, immune analysis subsystem based on network packets, which run on the mobile agent platform, can achieve the desired objectives completely.更多还原