一精確度可至單一主機單一Port之IP Spoofing 偵測法

以作者查詢圖書館館藏

、以作者查詢臺灣博碩士

、以作者查詢全國書目

、勘誤回報

、線上人數：43

、訪客IP：3.16.50.98

姓名

吳宏毅(Hung-I Wu) 查詢紙本館藏

畢業系所

資訊工程學系

論文名稱

一精確度可至單一主機單一Port之IP Spoofing 偵測法
(IP Spoofing Detector)

相關論文

★ USB WORM KILLER: Cure USB Flash Worms Through a USB Flash Worm	★ Discoverer- Rootkit即時偵測系統
★ 一項Android手機上詐騙簡訊的偵測與防禦機制	★ SRA系統防禦ARP欺騙劫持路由器
★ A Solution for Detecting and Defending ARP Spoofing on Virtual Machines	★ 針對遠端緩衝區溢位攻擊之自動化即時反擊系統
★ 即時血清系統: 具攻性防壁之自動化蠕蟲治癒系統	★ DNSPD: Entrap Botnets Through DNS Cache Poisoning Detection
★ TransSQL: A Translation and Validation-based Solution for SQL-Injection Attacks	★ A Spam Mail-based Solution for Botnet Detection and Network Bandwidth Protection
★ Shark: Phishing Information Recycling from Spam Mails	★ FFRTD: Beat Fast-Flux by Response Time Differences
★ Antivirus Software Shield against Antivirus Terminators	★ MAC-YURI : My ACcount, YoUr ResponsIbility
★ KKBB: Kernel Keylogger Bye-Bye	★ CIDP Treatment: An Innovative Mobile Botnet Covert Channel based on Caller IDs with P8 Treatment

檔案

[Endnote RIS 格式]

[Bibtex 格式]

[相關文章]

[文章引用]

[完整記錄]

[館藏目錄]

[檢視]

[下載]

本電子論文使用權限為同意立即開放。
已達開放權限電子全文僅授權使用者為學術研究之目的，進行個人非營利性質之檢索、閱讀、列印。
請遵守中華民國著作權法之相關規定，切勿任意重製、散佈、改作、轉貼、播送，以免觸法。

摘要(中)

由於今日網路攻擊多以IP spoofing 掩護攻擊者的來源位置、使得被攻擊者因難以找出攻擊者的真正位置，而無法有效的阻絕攻擊者的攻擊，此外 IP spoofing 亦常被用來發起 TCP session hijacking 或 Trusted host attacks 等造成嚴重資安問題的攻擊，因此發展出一快速精確的偽造封包偵測法，便成為一迫切及重要的議題。
在本篇論文中我們將研發出一全新且辨識度可精確至單一主機上單一socket之IP spoofing 偵測法 -- IP Spoofing Detector (ISD)。在不需要修改被保護網路內任何電腦的軟體及硬體的前題下，在不需使用任何加密解密金鑰的技術下，以edge router為基礎的 ISD，將可快速有效地偵測IP spoofed 封包，結合ingress egress filter的方法，使任一經由 ISD送出的封包皆經過來源的證實與確認，不論被保護的網路內部的電腦佈局有任何改變，不論被保護的網路是否允許mobile IPs，任何由 ISD 所在網路產生的且來源是偽造的IP封包皆能被其偵測及封鎖。
本篇論文利用TCP/IP協定中任一主機的 socket 在不同的狀態 (state)下對某些特殊的封包會產生不同回應的原理及 socket 在送出不同的封包後會進入不同的狀態的規定，借由目標主機對 ISD 送出的查證封包的反應來查證 ISD 所收到的封包的真偽。此外本論文亦利用TCP protocol中對建立通訊的兩台主機必需先完成3-way handshaking 後才能利用TCP封包傳遞資訊到對方的原則來減少查證封包的數目。根據以上的方法我們可以建立一辨識度可至單一主機上單一 TCP connection的快速 IP spoofing 偵測法。實驗顯示在僅需微量的工作負擔下，本法可有效地偵測出來源位址被偽造的IP封包。

摘要(英)

In this project， we plan to develop a novice IP spoofing detection solution named IP Spoofing Detector (ISD) to solve this notorious security threat to computers and networks. ISD can accurately recognize whether an IP packet belongs to a TCP connection indicated in the TCP/IP header of that packet and drop all spoofed IP packets. As a result， attackers can no longer launch attacks through spoofed IP packets from the network protected by ISD.
ISD will be an edge router-based solution to IP spoofing; hence， to install it there is no requirement to modify any software and hardware in any host of the protected network and there is no need to use any encryption and decryption method to authentication packets. After being installed， ISD can efficiently and effectively detect and block spoofed IP packets no matter how the layout of the protected network is changed and no matter whether mobile IPs are supported by the protected network.
Since the IP spoofing problem was reported to the public by S. Bellovin of Bell Lab. in 1989， it have been used by many attackers to either conceal the attack sources (such as DoS/DDoS attacks， port scanning decoy， and IdlesScan) or forge packets as coming from hosts trusted by attacked hosts to get access to the attacked hosts (such as Man-in-the-Middle Attacks and trusted host attack). The former thwarts victims’ capability to make appropriate response to attack traffic. The later disables attacked hosts’ authentication mechanism. Both result in great damage on attacked hosts. According to FBI， in 2003， DoS/DDoS attacks alone caused about sixty-six million dollar lost in the USA. The trend of this kind of attacks continues increasing.
According to TCP/IP protocol， the response of a socket to a packet changes when it is in a different state and the state of a socket changes after sending an IP packet. Based on the above principle， we can accurately confirm whether an IP packet was really sent by a specific socket. Besides， unless a 3-way handshaking is finished， a TCP connection can not be built; hence， for all packets claimed to belong to a TCP connection， ISD only needs to confirm the validity of the TCP SYN packet. The above rule can dramatically decrease the number of IP packets whose validity is needed to be verified. Based on the above analysis， we plan to develop and implement ISD on a Linux platform. The precision of the recognition of IDS could be to the socket level. Until now none of the IP spoofing detection solution could achieve such a fine precision level.

關鍵字(中)

★ 位址
★ 偽造
★ 偵測

關鍵字(英)

★ IP spoofing

論文目次

摘要 i
致謝 iii
目錄 iv
圖目錄 v
表目錄 vi
第一章緒論 1
1-1 研究背景與目的 1
1-1-1.DoS/DDoS Attack: 2
1-1-2.Port Scanning Decoy: 3
1-1-3.Trusted Host Attack: 3
1-1-4.Man-in-the-Middle Attack: 3
1-2 相關研究 4
為解決 IP Spoofing 此一嚴重影響資安秩序的問題，許多的研究資源已紛紛地投入此一領域，在以下的章節中我們將介紹一些主要的研究成果。 4
1-2-1 Ingress/Egress router: 4
1-2-2 StackPi: 4
1-2-3 Hop-countfiltering: 5
1-2-4 Spoofing Prevention Method: 5
1-2-5 SAVE: source address validity enforcement protocol: 5
1-3論文架構 6
第二章研究方法與原理 7
第三章 IP Spoofing Detector 10
3-1 查證封包必備的條件 10
3-2 Socket 的狀態與反應 11
3-3 推論 11
3-4 ISD演算法 13
3-5 等待時間 14
第四章程式系統架構 15
4-1 基本架構 15
4-2 程式內容簡述 17
第五章實驗與討論 19
5-1 實驗環境設定 19
5-2 實驗與結果 20
5-3 攻擊分析 25
5-4 Host A使用Microsoft Windows XP sp2 25
第六章結論 26
6-1 貢獻 26
6-2 總結 26
6-3 未來方向 26
參考文獻 27
附錄 30

參考文獻

〔1〕 Bellovin，S.M.， “Security Problems in the TCP/IP Protocol”， Computer Communication Review，Vol 19，No.2.32-48， 1989，April.
〔2〕 Matt Tanase， “Closing the Floodgates:DDos Mitgation Techniques”， http://www.securityfocus.com/infocus/1655
〔3〕 D. Moore， G.~M. Voelker， and S. Savage， “nferring Internet Denial-of-Service Activity”，in Usenix Security Symposium， Washington， D.C.， Aug 2001.
〔4〕 V. Paxson， “ An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks”， Computer Communication Review 31(3)， July 2001.
〔5〕 Mark Crother， “ IP Address Spoofing and Hijacked Session Attacks”， Bugtraq: CIAC Advisory F-08.
〔6〕 Dave Dittrich， “Session hijacking demonstration and notes”， http://althing.cs.dartmouth.edu/secref/resources/network-layer2.shtml
〔7〕 J. P. McDermott， “Attack net penetration testing”， workshop on New security paradigms， Ballycotton， Ireland， 2001.
〔8〕 WEISSMAN， C. “Penetration Testing”，Handbook for the Computer Security Certification of Trusted Systems.
〔9〕 P. Ferguson and D. Senie， “Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing”，' RFC 2267.
〔10〕 Perrig A.， Song D.， Yaar A. “StackPi: a new defense mechanism against IP spoofing and DDoS attacks.”CMU technical report. February 2003.
〔11〕 C. Jin， H. Wang and K. Shin. “Hop-count Filtering: An Effective Defense Against Spoofed DDoSAttacks，”ACM Computer and Communications Security， 2003.
〔12〕 A. Bremler-Barr and H. Levy， “Spoofing Prevention Method”， IEEE INFOCOM， Miami， FL， USA， March， 2005.
〔13〕 Jun Li， Jelena Mirkovic， Mengqiu Wang， Peter Reiher， Lixia Zhang. "SAVE: source address validity enforcement protocol，" IEEE INFOCOM， New York， New York， June 2002.
〔14〕 Lamont Granquist， “NMAP guide”，取自http://insecure.org/nmap/lamont-nmap-guide.txt
〔15〕 Insecure， “Idlescan”， http://insecure.org/nmap/idlescan.html
〔16〕 “2003 CSI/FBI Computer Crime and Security Survey. Security”，取自
http:// www.reddshell.com/docs/csi_fbi_2003.pdf
〔17〕 “Linux Networking Kernel” ，取自
http://www.ecsl.cs.sunysb.edu/elibrary/linux/network/LinuxKernel.pdf
〔18〕 “socket states” ，取自
http://www.cis.temple.edu/~ingargio/cis307/readings/unix4.html#states

指導教授

許富皓(Fu-Hau Hsu)

審核日期

2007-7-18

推文