| 摘要: | 本論文提出基於誘捕網路蜜罐設計與螞蟻演算法追蹤之入侵偵測與駭客行為分析機制，其架構包含監控、追蹤與分析等三個模組。所有網路駭客入侵的路徑與行為均透過此模型分析驗證。在誘捕網路中所建置的蜜罐，其資料庫、目錄與系統相關安全參數等均採自動化與動態併行更新，除配予相應費洛蒙權重以記錄駭客入侵路徑及竊取資料庫文件之過程，並導入螞蟻演算法對駭客入侵之攻擊能力做有效之估測，實驗證明本機制確具良好分析與追蹤效能。
In this paper, a novel intrusion behaviour analysis mechanism based on the design of honeynet and the diagnosis of ant colony algorithm has been proposed. In which, there are three modules including the monitor module, track module, and analyzed module developed. The intrusive behaviour is then analysis through the above modules. In the developed honey pot, all of the architecture, database, directory, security parameters are updated dynamically and timely to evade the probe test from the intruders. To record the traverse of an intrusion, the pheromone will be deposited as discovered. In addition, in order to exactly and correctly measure the capability of the intruders, the content of those discovered file, path and database will be updated and the security setting will also be enhanced timely to raise the difficulty of visiting or access again. All of the traversal of intruders and the corresponding behaviour will be analyzed based on ant colony algorithm. Experimental results demonstrate that the proposed IDS mechanism possesses good efficiency and performance. |
