利用Netflow即時偵測蠕蟲攻擊

Abstract

在這篇論文，我們發展了一個利用Cisco Netflow資料來即時偵測蠕蟲攻擊的方法。利用這個方法，可以在蠕蟲發動掃描攻擊時，有效辨識出發動攻擊的電腦IP位址，接著就可以在路由器上將發動攻擊的IP位址阻擋掉，避免這些大量的掃描動作影響網路的正常運作。藉由在收到Netflow資料之後即時分析，只針對異常的Netflow資料進行統計，若統計結果大於預先設定的臨界值，就發出蠕蟲攻擊警報。我們所發展的方法只需要少量的記憶體和CPU，並且不需蠕蟲的特徵資料。經實驗證實，我們所提出的方法是一個實用的方法。

In this paper, we develop one method that utilizes Cisco Netflow packets to real-time detect the worm attacks. By this way, we can identify the IP address which launch the worm attack, and block them on the router using access list control to keep the network work smooth. We process the received Netflow data in memory and drop useless data. The method that we develop only needs a small amount of memory and CPU, and does not need the signatures of the worm. By some experiments, the proposed method is proven to be an efficient one.