学位论文 > 优秀研究生学位论文题录展示

入侵检测系统（IDS）：拒绝服务攻击的信息和分析

作　者: 葛拉迪
导　师: 干刘
学　校: 华中科技大学
专　业: 通信与信息系统
关键词: 入侵检测系统网络入侵检测入侵仿真 DoS攻击 OPNET
分类号: TP393.08
类　型: 硕士论文
年　份: 2010年
下　载: 49次
引　用: 0次
阅　读: 论文下载

内容摘要

组织往往缺乏全面的安全政策,并且并不准备充分保护他们的系统以防止被外界入侵。虽然网络入侵检测系统的使用越来越普遍,但是正确的评价其性能仍然具有很大的挑战性。对于出现在系统收集到的网络日志中的入侵,防火墙和其他简单的边界设备缺乏一定的智能程度,尤其是当观察,识别,并确定攻击特性时。在本文中,我们首先在局域网/广域网环境下学习入侵检测系统(IDS)相关问题。此外,借助Wireshark和opnet方针工具,我们生成(群扑杀活侵入交通跟踪从)从僵尸网络(Bonet)、服务器信息块协议(SMB)和ARP缓存攻击中收集数据包,并建立它们入侵痕迹的存储库,这些攻击来自Pcapr– Mu动态研究实验室和开放的包组织。我们实验的方法是使用结果Opnet仿真器。仿真结果显示了再没有防火墙隧道时,我们提出的机制在3个拒绝服务攻击(DoS)情况下的检测能力,我们将看到应用程序的响应时间将增加,传输延迟的增加和网络吞吐量的明显下降,这为我们对维持能源效率及改善LAN/WAN网络安全的分析提供了基础。

全文目录

Dedication  4-5
TABLE OF CONTENTS  5-8
LIST OF FIGURES AND TABLES  8-11
Abstract  11-12
摘要  12-13
CHAPTER 1  13-22
  1.1 Introduction -Research Focus and Objectives  13-15
  1.2 Problem Statement  15-16
  1.3 Hypothesis  16-17
  1.4 Objectives and Approach  17-18
  1.5 Overarching Objective  18-19
  1.6 Motivation for Evaluating Intrusion Detection Systems (IDS)  19-20
  1.7 Paper Outline  20-22
CHAPTER 2 An Intrusion Detection System (IDS)  22-46
  2.1 What is an (IDS)?  22-23
  2.2 Host-Based IDS (HIDS)  23-24
  2.3 Network-Based IDS (NIDS)  24-26
  2.4 Characterizing an IDS  26
  2.5 Network-based IDS characteristics  26-27
  2.6 Host-based IDS characteristics  27
  2.7 Application-based IDS characteristics  27-28
  2.8 Signature-based IDS characteristics  28-29
  2.9 Anomaly-based IDS characteristics  29-30
  2.10 Requirements for IDS  30-32
  2.11 IDS: A brief history  32-34
  2.12 What is not an IDS?  34-37
  2.13 IDS Techniques  37-38
  2.14 Anomaly Detection  38-41
  2.15 Misuse Detection  41-46
CHAPTER 3 Contributions  46-79
  3.1 IDS and related works  46-48
  3.2 LAN/WAN Environment  48
  3.3 The LAN/WAN Security Problem  48
  3.4 Distributed File Storing – Concerns  48-49
  3.5 Remote Computing – Concerns  49
  3.6 Messaging Services – Concerns  49
  3.7 Other LAN/WAN Security Concerns  49-50
  3.8 Goals of LAN/WAN Security  50-51
  3.9 Threats, Vulnerabilities, Services & Mechanisms  51-52
   3.10 Threats and Vulnerabilities  52-53
   3.11 Unauthorized LAN/WAN Access  53-54
  3.12 Inappropriate Access to LAN/WAN Resources  54-55
  3.13 Unauthorized Modification of Data and Software  55-56
  3.14 Disclosure of LAN/WAN Traffic  56
  3.15 Spoofing of LAN Traffic  56-57
  3.16 Security Services and Mechanisms  57-58
  3.17 Identification and Authentication  58-61
  3.18 Access Control  61-63
  3.19 Data and Message Confidentiality  63-65
  3.20 Data and Message Integrity  65-67
  3.21 Non-repudiation  67
  3.22 Logging and Monitoring  67-68
  3.23 Risk Management  68-69
  3.24 Current Approaches  69-71
  3.25 IEEE 802.3 Local Area Network (LAN) protocols  71-74
  3.26 Ethernet: IEEE 802.3 LAN protocols: Ethernet MAC Data Frame for 10/100Mbps Ethernet  74
  3.27 MAC Frame with Gigabit Ethernet Carrier Extension (IEEE 803.3z)  74-76
  3.28 Denial of Service Attacks (DoS): LAN/WAN Environment  76-79
CHAPTER 4 Network Simulation with OPNET  79-91
  4.1 OPNET Simulation Tool: Overview  79-84
  4.2 Hierarchical Modeling  84
  4.3 Network Model  84-85
  4.4 Node Model  85-86
  4.5 Process Model  86-87
  4.6 Running Simulation - Simulation Editor  87-88
  4.7 Data Generation - Probe Editor  88-89
  4.8 Analysis Tool  89
  4.9 Filter Tool  89-91
CHAPTER 5 Simulation Models  91-111
  5.1 Simulated attacks  92-93
  5.2 Network Model Development  93-95
  5.3 Probes and Modifications to the Models  95-98
  5.4 Attacks Classifications  98
  5.5 Bandwidth/Throughput Attacks  98-99
  5.6 Man in the Middle (ARP Cache) Attack  99-100
  5.7 Poisoning the Cache  100-101
  5.8 Protocol Attacks  101
  5.9 Server Message Block (SMB) Attack  101-102
  5.10 SMB Reflection Attack  102-103
  5.11 Software Vulnerability Attacks  103
  5.12 Botnet Attack  103-105
  5.13 Network Analyzer (Wireshark)  105-111
CHAPTER 6 Results Analysis  111-136
  6.1 Man in the Middle (ARP Cache): Attack Analysis  113
  6.2 Summary of Delays  113-115
  6.3 Application Doctor Analysis  115
  6.4 Test Results  115-119
  6.5 Botnet: Attack Analysis  119-120
  6.6 Summary of Delays  120-121
  6.7 Application Doctor Analysis  121-122
  6.8 Test Results  122-126
  6.9 Server Message Block (SMB): Attack Analysis  126-127
  6.10 Summary of Delays  127-128
  6.11 Application Doctor Analysis  128-129
  6.12 Test Results  129-136
CHAPTER 7 Discussions  136-148
  7.1 Summary  140-141
  7.2 Future Directions: IDS  141-142
  7.3 Problems for Modern IDS  142-143
  7.4 Immediate Future  143
  7.5 Long Term  143-145
  7.6 IDS and Prevention: Future  145-148
CHAPTER 8 Conclusion  148-149
ACRONYMS  149-152
ACKNOWLEDGEMENT  152-153
REFERENCE  153-156

入侵检测系统（IDS）：拒绝服务攻击的信息和分析

内容摘要

全文目录

相似论文