網站入侵偵測系統之分析與研究

Analysis and Study of Web Intrusion Detection System

10.6382/JIM.200301.0183

施東河(Dong-Her Shih)；黃于爵(Yu-Chei Hwang)

入侵偵測系統 ； 駭客 ； 類神經網路 ； 自組織映射圖網路 ； Intrusion detection system ； Hacker ； Neural network ； Self-Organizing Map SOM

資訊管理學報

9卷2期（2003 / 01 / 01）

183 - 214

繁體中文

網路安全對MIS資訊人員來說非常重要，然而技術人員的技術與知識越來越難跟上不斷出現的安全漏洞與攻擊手法。在日新月異的資訊安全問題中，如何及時找出網路安全的弱點，適時地、有效率的定期評估稽核自我網路安全狀況，成了當前企業與MIS資訊人員首要關切的議題。本文除廣泛搜集現有市面上所有的網站入侵行為與攻擊軟體外，並根據國內外入侵偵測系統的探討，提出綜合Network-based misuse model與Host-based anomaly model的WIDS入侵偵測系統。本研究採用類神經網路中的自組織映射圖網路架構，並試圖提出一套具有學習能力的WIDS網站入侵偵測系統，期望能解決日新月異不斷翻新的攻擊手法，使得系統得以自我學習保護，使駭客攻擊傷害能降到最小。經過實證，本研究之入侵偵測系統正確率高達86%以上。

Network security to MIS personnel is very important. However, the technique and knowledge of the technician is getting hard to catch up with more and more secure leak and attack skill. During the improving of information security, to find out the weakness of network security instantly is very important. Also, to efficiently and correctly estimate and examine one's own security condition has become the first important theme for current enterprise and MIS personnel. Our research, adopt the neural network type of SOM (Self-Organizing Map) structure, and try to propose a self-learning WIDS (Web Intrusion Detection System) which have the learning ability to detect the invade of network system. Our expectation is to solve the continuously changed invading attack problems. Through our WIDS (Web Intrusion Detection System), provided our system self-study ability so learn to protect system itself, also minimize hackers' attack. After testing and verifying, our research of WIDS (Web Intrusion Detection System) can be successfully detected up to 86% correctness.

1. Anderson, J. P.(1980).Computer security threat monitoring and surveillance.Fort Washington, PA:James P. Anderson Co..
2. Balasubramaniyan, J. S.,Garcia-Fernandez, J. O.,Isacoff, D.(1998).An Architecture for Intrusion Detection using Autonomous Agents.
3. Bauer, D. C.,Cannady, J.,Garcia, R. C.(2001).SoutheastCon Proceedings, IEEE.
4. Bonifacio, Jr. J. M.,Cansian, A. M.(1998).Neural Networks Proceedings, IEEE World Congress on Computational Intelligence, vol. 1.
5. Feiertag, R.,Rho, S.,Benzinger, L.,Wu, Stephon,Redmond, T.(2000).Intrusion Detection inter-component adaptive negotiation.Computer Networks,34
6. Haykin, S.(1994).Neural Networks: A Comprehensive Foundation.Macmillan College Publishing Company, Inc..
7. Helmer, G.,Wong, Johnny,Slagell, M.(2000).Proceedings of the 1st Symposium on Requirements Engineering for Information Security.
8. Kemmerer, R. A.(1997).NSTAT: A Model-based Real-time Network Intrusion Detection System.Computer Science Dep., University of California Santa Barbara.
9. Kohonen, T.,Kangas, J. A.,Laaksonen, J. T.(1990).Variants of self-organizing maps.IEEE Transactions on Neural Networks,1(1)
10. Lee, Susan C.,Heinbuch, D. V.(2001).Training a Neural-Network Based Intrusion Detector to Recognize Novel Attacks.IEEE Transactions on Systems, Man and Cybernetics, Part A,31(4)
11. Lee, Wenke,Numbalkar, R. A.,Yee, Kam K.(2000).Proceedings of 3rd International Workshop on the Recent Advances in Intrusion Detection.
12. Mukherjee, B.,Heberlein, L. T.,Levitt, K. N.(1994).Network Intrusion Detection.IEEE Network,8(3)
13. Ning, Peng,Jajodia, S.,Wang, Sean Xiaoyang(2001).Abstraction-based Intrusion Detection in Distributed Environments.ACM Transactions onInformation and System Security,4(4)
14. Porras, P. A.,Neumann, P. G.(1997).Proceedings of the 20th National Information Systems Security Conference.Baltimore, Maryland, USA:National Institute of Standards and Technology/ National Computer Security Center.
15. Verwoerd, T.,Hunt, R.(2002).Security architecture testing using IDS - A Case Study.Computer Communications,25(15)
16. Vigna, G.,Kemmerer, R.(1998).Proceedings of the 14th Annual Computer Security Application Conference.Scottsdale, Arizona:
17. 尤焙麟(2001)。駭客現形：網路安全之秘辛與解決方案。台北:麥格羅．希爾。
18. 丘偉權(2001)。以類神經網路建構入侵偵測系統。國立成功大學電機工程學系。
19. 李勁頤 、陳奕明 Chen, Yi-Ming(2002)。分散式入侵偵測系統研究現況介紹。資訊安全通訊 Information Security Newsletter，8(2)
20. 李駿偉 、田筱榮 Tyan, Hsiao-Rong、黃世昆 Huang, Shih-Kun(2002)。入侵偵測分析方法評估與比較。資訊安全通訊 Information Security Newsletter，8(2)
21. 洪蘭 Hung, Daisy L.(1994)。天生嬰才：重新發現嬰兒的認知世界。遠流出版社。
22. 曾憲雄 Tseng, Shian-Shyong,林耀聰 Lin, Yao-Tsung,林順傑 Lin, Shun-Chieh(2001).An Intrusion Detection Model Based Upon Intrusion Detection Markup Language (IDML).Journal of Information Science and Engineering,17(6)
23. 鄭有倫(2000)。具反偵察能力之分散式網路入侵偵測系統之設計與實現。國立成功大學電機工程學系。
24. 蘇木春 、張孝德(2000)。機器學習：類神經網路、模糊系統及基因演算法則。台北:全華科技。

1. 謝佳容、陳良駒、范俊平(2016)。網路作戰安全與管理主題實證探索之研究－使用GHSOM 技術。資訊管理學報，23(1)，99-128。