فهرست:
1. کلیات... 2
1-1. مقدمه................................................................................................................................................2
1-2. اهدف تحقیق.. 3
1-3. تعاریف اولیه... 4
1-3-1. نفوذ. 4
1-3-2. نفوذگر. 5
1-3-3. سیستم های شناسایی نفوذ. 6
1-3-4. سیستم های پیشگیری از نفوذ. 6
1-3-5. دیوار آتش.... 7
1-4. چالشهای مسئله. 7
1-5. نگاهی به فصول پایان نامه. 9
2. مبانی نظری تحقیق.. 12
2-1. مقدمه....................... 12
2-2. طبقه بندی سیستم های تشخیص نفوذ. 13
2-2-1. منبع اطلاعاتی.. 13
2-2-1. روش تحلیل.. 15
2-2-2. نحوه نظارت... 16
2-2-3. روش پاسخگویی.. 17
2-3. جریان شبکه... 20
2-3-1. تعریف جریان شبکه. 20
2-4. انواع حملات..... 22
3. پیشینه تحقیق.. 28
3-1. مقدمه.................... 28
3-2. روش مبتنی بر جریان در برابر روش مبتنی بر محتوا 28
3-2-1. داده جریان شبکه. 29
3-2-2. روش های مبتنی بر بسته. 30
3-2-3. روش های مبتنی بر جریان.. 30
3-2-4. کرم ها 31
3-2-5. محدود کننده سرویس.... 34
3-2-6. پویش.... 36
3-2-7. Botnet 39
4. روش پیشنهادی.. 43
4-1. مقدمه............................................................................................................................................43
4-2. مجموعه داده ................................................................................................................................43
4-3. معیارهای شباهت... 45
4-3-1. معیارهای مبتنی بر گراف... 45
4-3-1-1. ضریب خوشه بندی محلی.. 45
4-3-1-2. ضریب خوشه بندی وزن دار محلی.. 46
4-3-2. معیارهای مبتنی بر گره 48
4-3-2-1. میانگین شباهت محلی.. 48
4-3-2-2. نسبت درجه گره 49
4-3-2-3. معیار Zscore. 49
4-4. شناسایی نفوذگران.. 51
5. آزمایشات و نتایج.. 53
5-1. مقدمه..................... 53
5-2. شبیه سازی گراف شبکه. 53
5-3. ساخت گراف یک سویه. 56
5-4. مقایسه معیارهای شباهت... 57
5-5. نتایج................. 58
فهرست منابع.. 60
منبع:
Q. Ding, N. Katenka, P. Barford, E. Kolaczyk, and M. Crovella, “Intrusion as (Anti)social Communication: Characterization and Detection”, Proceeding of KDD Conference, Beijing, China, August 2012.
K. Rajasekhar, B. Sekhar Babu, P. L. Prasanna, D. R. Lavanya, and T. V. Krishna, “An Overview of Intrusion Detection System Strategies and Issues”, International Journal of Computer Science & Technology, vol. 2, issue 4, Oct.- Dec. 2011.
M. Gandhi and S.K.Srivatsa, “Detecting and preventing attacks using network intrusion detection systems”, International Journal of Computer Science and Security, vol. 2, Issue 1, 2008.
G. M. Nazer and A. L. Selvakumar,”Current Intrusion Detection Techniques in Information Technology - A Detailed Analysis”, European Journal of Scientific Research, vol. 65, no. 4, pp. 611-624, 2011.
Y. Jin, E. Sharafuddin, and Z. Zhang, “Unveiling core network-wide communication patterns through application traffic activity graph decomposition”, Proceedings of ACM SIGMETRICS, Seattle, WA, June 2009.
G. Cormode, F. Korn, S. Muthukrishnan, and Y. Wu, “On signatures for communications graphs”, Proceedings of International Conference on Data Mining, Cancun, Mexico, April 2008.
P. McDaniel, S. Sen, O. Spatscheck, J. Merwe, B. Aiello, and C. Kalmanek, “Enterprise security: A community of interest based approach”, Proceedings of Network and Distributed System Security Symposium (NDSS), San Diego, CA, February 2006.
S. Venkataraman, D. Song, P. B. Gibbons, and A. Blum, “New Streaming Algorithms for Fast Detection of Superspreaders”, Proceedings of Network and Distributed System Security Symposium (NDSS), 2005.
Y. Jin, J. Cao, A. Chen, T. Bu, and Zh. L. Zhang, “Identifying high cardinality Internet hosts”, Proceedings of IEEE INFOCOM, Rio de Janeiro, Brazil, April 2009.
E. E. Papalexakis, A. Beutel and P. Steenkiste, “Network Anomaly Detection using Co-clustering”,Proceeding of International Conference on Advances in Social Networks Analysis and Mining (ASONAM), Istanbul, Turkey, 2012.
M. Tubi, R. Puzis, and Y. Elovici, “Deployment of DNIDS in Social Networks”, Proceeding of IEEE Intelligence and Security Informatics, USA, New Jersey, New Brunswick, May 2007.
A. J. O’Donnell, W. C. Mankowski, and J. Abrahamson, “Using Email Social Network Analysis for Detecting Unauthorized Accounts”, Proceedings of Conference on Email and Anti-Spam, Mountain View, CA, 2006.
S. Rubin, S. Jha, and B. Miller, “Automatic generation and analysis of NIDS attacks”, Proceedings of Annual Computer Security Applications Conference (ACSAC), Tucson, AZ, December, 2004.
J. Ullrich, The Dshield Project, http://www.sans.org, 2012.
Q. Ding, N. Katenka, P. Barford, E. Kolaczyk, and M. Crovella, "Intrusion as (anti) social communication: characterization and detection," Proc. of the 18th ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 886-894. ACM, 2012.
A. Sperotto, G. Schaffrath, R. Sadre, C. Morariu, A. Pras, and B. Stiller, "An Overview of IP Flow-Based Intrusion Detection," Communications Survays & Tutorials, IEEE , vol.12, no.3, pp. 343-356, Third Quarter 2010.
A. Sardar, I. Ul Haq, S. Rizvi, N. Rasheed, U. Sarfraz, S.A. Khayam, and F. Mirza, "On mitigating sampling-induced accuracy loss in traffic anomaly detection systems," ACM SIGCOMM Computer Communication Review 40, no. 3, pp. 4-16, 2010.
P. Garcia-Teodoro, J. Diaz-Verdejo, G. Maciá-Fernández, and E. Vázquez, "Anomaly-based network intrusion detection: Techniques, systems and challenges," computers & security 28, no. 1, pp. 18-28, 2009.
Wikipedia is a free encyclopedia, Available: http://en.wikipedia.org/wiki/ Intruder_detection.
S. Venkataraman, D. Song, P.B. Gibbons, and A. Blum, "New streaming algorithms for fast detection of superspreaders," Department of Electrical and Computing Engineering, 6, 2005.
J. Cao, Y. Jin, A. Chen, T. Bu, and Z.L. Zhang, "Identifying High Cardinality Internet Hosts," INFOCOM 2009, IEEE , pp.810-818, 19-25 April 2009.
Q. Zhao, J. Xu, and A. Kumar, "Detection of Super Sources and Destinations in High-Speed Networks: Algorithms, Analysis and Evaluation," Selected Areas in Communications, IEEE Journal on, vol.24, no.10, pp.1840,1852, Oct. 2006.
M. Tubi, R. Puzis, and Y. Elovici, "Deployment of DNIDS in Social Networks," Intelligence and Security Informatics, 2007 IEEE, pp.59,65, 23-24 May 2007.
A. Wagner, and B. Plattner, "Entropy based worm and anomaly detection in fast IP networks," Enabling Technologies: Infrastructure for Collaborative Enterprise, 2005. 14th IEEE International Workshops on , pp.172,177, 13-15 June 2005.
A.L. Barabási, A. Réka, and H. Jeong, "Mean-field theory for scale-free random networks," Physica A: Statistical Mechanics and its Applications 272, no. 1, 173-187, 1999.
T. Opsahl, and P. Panzarasa. "Clustering in weighted networks." Social networks 31, no. 2, 155-163, 2009.
D. M. Pennock, G. W. Flake, S. Lawrence, E. J. Glover, and C. L. Giles, "Winners don't take all: Characterizing the competition for links on the web," The national academy of sciences 99, no. 8, 5207-5211, 2002.
L.T. Heberlein, G.V. Dias, K.N. Levitt, B. Mukherjee, J. Wood, and D. Wolber, "A network security monitor," Research in Security and Privacy, 1990. Proceedings, 1990 IEEE Computer Society Symposium on, pp.296, 304, 7-9 May, 1990.
K.A. Zweig, "How to Forget the Second Side of the Story: A New Method for the One-Mode Projection of Bipartite Graphs," Advances in Social Networks Analysis and Mining (ASONAM), 2010 International Conference on, pp.200,207, 9-11 Aug. 2010.
E.A. Horvat, and K.A. Zweig, "One-mode Projection of Multiplex Bipartite Graphs," Advances in Social Networks Analysis and Mining (ASONAM), 2012 IEEE/ACM International Conference on, pp.599-606, 26-29 Aug. 2012.
J. Vykopal, M. Drašar, and Ph. Winter, "Flow-based Brute-force Attack Detection," Advances in IT Early Warning. Garching near Muenchen: Fraunhofer Research Institution AISEC, pp. 41-51, 2013.
T. Kymie, B. Johnson, and A. Viswanathan, "Towards reliable evaluation of anomaly-based intrusion detection performance" Jet Propulsion, 2012.
D. Jisa, and C. Thomas, "Denial of Service Attack Detection using Flow-based Analysis of Network Traffic," 2013.
J. McHugh, "Testing intrusion detection systems: a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory," ACM transactions on Information and system Security 3, no. 4, pp. 262-294, 2000.
Sonrt home page, http://www.snort.org.
Bro homepage, http://bro.org.
Y. Jin, E. Sharafuddin, and Z.L. Zhang, "Unveiling core network-wide communication patterns through application traffic activity graph decomposition," Proce. of 11th international joint conference on Measurement and modeling of computer systems, pp. 49-60. ACM, 2009.
L. Bilge, Th. Strufe, D. Balzarotti, and E. Kirda, "All your contacts are belong to us: automated identity theft attacks on social networks," Proc. of the 18th international conference on World Wide Web, pp. 551-560. ACM, 2009.