An Extensible and Modularized Kernel-level Intrusion Prevention System

[[abstract]]電腦科技應用的普及與網際網路技術的蓬勃發展，越來越多的使用者透過網路來傳遞或儲存重要的資料。然而隨著使用者的增加，伴隨而來的駭客攻擊、竊取個資的事件頻傳，而駭客的攻擊手法也不斷地更新。許多偵測網路攻擊的工具因此相繼地被開發出來，其中又以入侵偵測系統(Intrusion Detection System，IDS)為最常被用來保護系統的安全。 本論文是以虛擬機器監控層的具擴展性的入侵偵測與防禦系統(Virtual Machine Monitor based Extensible Intrusion Prevention System，VMM-EIPS)為基礎。VMM-EIPS具備動態Plug-in功能的模組化架構，提供了多個掛勾點(Hook)，可以讓使用者動態地新增或刪除功能元件。而VMM-EIPS是實作成Linux核心模組(Kernel Module)，被掛載在Linux Kernel的網路封包過濾子系統- Net-Filter的PREROUTING掛勾點上，所以能夠攔截所有進入系統的封包來進行檢測。 我們擴展了VMM-EIPS的動態Plug-in架構，讓系統的檢測方式不僅是透過誤用偵測，亦可透過異常偵測方式來檢測封包，並且設計與實作三個新的功能元件，是有關偵測IDS Evasion攻擊與非偽裝IP的TCP SYN Flood攻擊的功能元件，我們將所實作的系統重新命名為EIPS+。同時，我們也加入彈性化的封包檢測反應機制，使得EIPS+系統的防禦與回應功能更加完善。 實驗結果顯示我們所新增的檢測IDS Evasion技術的功能元件可以有效地偵測出相關的IDS Evasion的攻擊，且新增的檢測TCP SYN Flood攻擊的功能元件，亦可以有效地檢測出非偽裝IP類的阻斷服務(Denial-of-Service，DoS)攻擊。與開放原始碼中著名的入侵偵測系統預設的Snort相比，EIPS+可以檢測出更多使用IDS Evasion技術攻擊的封包，且系統運作EIPS+有較佳的效能，掛載EIPS+對系統所造成的負擔也相對地較小。我們亦發現，在大量的網路封包進入系統時，EIPS+仍可以有效率地處理每個封包，然而Snort則隨著封包的數量增加，封包丟棄率(Drop Rate)卻是大幅地上升，影響保護系統安全的能力。[[abstract]]As the popularity of computer applications and the rapid development of Internet technology, more and more users transmit or store important information through the internet. However, with the increase in the users, accompanied by hacker attacks, hacking techniques are diverse and constantly updated. Many of the tools to detect network attacks have been developed in succession, in which the Intrusion Detection System (IDS) is most commonly used to protect the system security. This thesis is based on the research, the Virtual Machine Monitor Based Extensible Intrusion Prevention System (VMM-EIPS), which adopts the modular architecture and is developed with dynamic plug-in functionality. VMM-EIPS provides several hook points, allowing users to dynamically add or remove functional components. VMM-EIPS is implemented as a Linux kernel module, and is mounted on the PREROUTING hook point of the network packet filtering subsystem, i.e. Net-Filter. Therefore, it can intercept and examine all packets entering into the system. We have expanded the dynamic plug-in architecture of the VMM-EIPS, so that it can use the misuse detection and the abnormal detection to examine network packets. Besides, we have designed and implemented three new functional components. Two of them are used for the detection of IDS evasion attacks and one for TCP SYN flood attack with non-forged IPs. The system is then renamed to EIPS+. Moreover, we also add the flexible reaction mechanism into the EIPS+, making the functionalities of intrusion detection, prevention, and reaction of the EIPS+ more complete. The experimental results show that our newly developed detecting components can effectively detect the associated IDS evasion attacks, and detect whether the system is under TCP SYN flood attack with non-forged IPs. Compared with the default Snort which is an open-source famous IDS, EIPS+ can detect more attack packets using IDS evasion technology, and incur relatively less overhead on the system performance. Therefore, the system operating with EIPS+ has better performance. We also found that when there are a large number of incoming network packets, EIPS+ still can efficiently handle each packet. Whereas, as the number of packets increases, packet drop rate for Snort substantially increases, which impacts the ability to protect the system.[[note]]碩