臺灣博碩士論文加值系統

在資安威脅的演進中，大規模的攻擊行為已不多見，網路攻擊新趨勢已朝向「個人化」發展，因而現今企業機關資料洩漏事故已大為增加，對於任何規模的公司與機關來說這都屬於最不利的狀況，被鎖定的公司不僅會有損失商譽風險，也可能造成以百萬計的損失，促使目標式攻擊是近來最熱門的資安議題之一。
本研究針對目標式攻擊，透過整合不同的網路安全設備資訊，依攻擊行為以不同的設備偵測，將各日誌匯入雲端平台進行儲存、整合、分析，進而降低受到攻擊與遭竊取重要資訊的機會，在目標式攻擊不易偵測與大量日誌需整合的環境下，以最短的時間做出應對措施，並斷絕未來可能發生之攻擊。

Due to the progress of information security and files stolen, a large-scale cyber-attack is ubiquitous in these days. To prevent the target-attack is very important and has become a trend. Nowadays, the leakage of confidential information has increasingly influenced the government and enterprises. To the company, property and the reputation will also be impacted if a company did not implement a privacy methodology to protect the data. However, the information security problems have become a serious issue.
In these huge logs, the target-attack is not easy to detect in the data processing procedure. In this study proposed an efficiency detection platform through using these logs from the different networking devices. We import the data in the cloud platform to storage, integrate, analysis and report the security weakness, hoping to enhance the security and prevent the attack immediately in the future.

內容目錄
中文摘要　．．．．．．．．．．．．．．．．．．．． iii
英文摘要　．．．．．．．．．．．．．．．．．．．． iv
誌謝辭　　．．．．．．．．．．．．．．．．．．．． v
內容目錄　．．．．．．．．．．．．．．．．．．．． vi
表目錄　　．．．．．．．．．．．．．．．．．．．． vii
圖目錄　　．．．．．．．．．．．．．．．．．．．． viii
第一章　　緒論．．．．．．．．．．．．．．．．．． 1
　　第一節　　研究背景．．．．．．．．．．．．．． 1
　　第二節　　研究動機與目的．．．．．．．．．．． 3
第二章　　文獻探討．．．．．．．．．．．．．．．． 7
　　第一節　　零時差攻擊．．．．．．．．．．．．． 7
　　第二節　　C&C入侵式攻擊．．．．．．．．．． 8
　　第三節　　雲端運算技術．．．．．．．．．．．． 8
　　第四節　　雲端技術之資安應用．．．．．．．．． 14
　　第五節　　支援向量機．．．．．．．．．．．．． 14
第三章　　研究方法．．．．．．．．．．．．．．．． 16
　　第一節　　系統流程．．．．．．．．．．．．．． 16
　　第二節　　雲端平台環境中的入侵偵測系統．．．． 20
第四章　　系統評估．．．．．．．．．．．．．．．． 25
第五章　　結論．．．．．．．．．．．．．．．．．． 31
參考文獻 ．．．．．．．．．．．．．．．．．．． 32
附錄 ．．．．．．．．．．．．．．．．．．． 35



表　目　錄
表 2-1 Hadoop雲端技術對入侵偵測系統之影響．．． 10
表 3-1 惡意連結原始日誌欄位．．．．．．．．．．． 17
表 3-3 入侵防禦系統原始日誌欄位．．．．．．．．． 18
表 3-4 惡意附加檔案原始日誌欄位．．．．．．．．． 18
表 3-4 防火牆原始日誌欄位．．．．．．．．．．．． 19
表 3-5 篩選後入侵防禦系統特徵值．．．．．．．．． 20
表 3-6 篩選後入侵防禦系統特徵值資料範例格式．．． 21
表 4-1 雲端叢集伺服器節點硬體資訊．．．．．．．． 26
表 4-2 雲端叢集伺服器節點軟體資訊．．．．．．．． 26
表 4-3 SVM使用參數．．．．．．．．．．．．．． 27
表 4-4 各月份所蒐集攻擊主機數．．．．．．．．．． 28
表 4-5 未篩選特徵值與篩選過特徵值效能．．．．．． 28
表 4-6 系統判定比較之評估準則．．．．．．．．．． 29
表 4-7 未篩選特徵值與篩選過特徵值目標式攻擊之比較 30










圖目錄
圖 1- 1 目標式攻擊的六個步驟．．．．．．．．．． 4
圖 2- 1 巨量資料環境中Hadoop架構與資料處理流程圖 9
圖 2- 2 檔案使用HDFS分散式檔案系統進行儲存．．． 11
圖 2- 3 HDFS將檔案分散儲存於3個datanode上．．． 11
圖 2- 4 MapReduce執行流程．．．．．．．．．．．． 12
圖 2- 5 Spark架構下之雲端運算流程圖．．．．．．． 13
圖 3- 1 主要系統流程圖．．．．．．．．．．．．．． 17
圖 3- 2 雲端叢集環境圖．．．．．．．．．．．．．． 23
圖 3- 3 SVM分析過程圖．．．．．．．．．．．．． 24
圖 4- 2 雲端叢集伺服器資訊．．．．．．．．．．．． 27

一、中文部分

趨勢科技全球技術支援與研發中心(2015)，什麼是針對性攻擊/鎖定目標攻擊 ( Targeted attack )? [線上資料]，來源：http://blog.trend-micro.com.tw/?p=14753 [2015, May 11]。

二、英文部分

Apache Spark. (2017). Cluster Mode Overview. Components [Online]. Available:https://spark.apache.org/docs/latest/cluster-overview
.html [2017, May 2].

Bottazzi, G., & Italiano, G. F. (2015, October). Fast Mining of Large-Scale Logs for Botnet Detection: A Field Study. In Computer and Information Technology; Ubiquitous Computing and Communi-cations; Dependable, Autonomic and Secure Computing; Per-vasive Intelligence and Computing (CIT/IUCC/DASC/PICOM), 2015 IEEE International Conference on (pp. 1989-1996). IEEE.

Fetjah, L., Benzidane, K., Alloussi, E. H., Warrak, E.O., Jai-Andaloussi, S., & Sekkaki, A. (2016, June). Toward a Big Data Architecture for Security Events Analytic. In Cyber Security and Cloud Computing (CSCloud), 2016 IEEE 3rd International Conference on (pp. 190-197). IEEE.

Hao, S., Hu, J., Liu, S., Song, T., Guo, J., & Liu, S. (2015, December). Network traffic classification based on improved DAG-SVM. In Communications, Management and Telecommunications (ComManTel), 2015 International Conference on (pp. 256-261). IEEE.

infovision. (2016). Service Offerings. Big Data Hadoop Architecture [Online]. Available:http://www.infovision.com/services/technol ogy-solutions/big-data-analytics/service-offerings[2017, May 2].

Kao, C.N., Chang, Y.C., Huang, N.F., Liao, I.J., Liu, R.T., & Hung, H.W. (2015, September). A predictive zero-day network defense using long-term port-scan recording. In Communications and Network Security (CNS), 2015 IEEE Conference on (pp. 695-696). IEEE.

Kulariya, M., Saraf, P., Ranjan, R., & Gupta, G.P. (2016, April). Performance analysis of network intrusion detection schemes using Apache Spark. In Communication and Signal Processing (ICCSP), 2016 International Conference on (pp. 1973-1977). IEEE.

Mathew, K., Tabassum, M., & Siok, M.V .L.A. (2014, August). A study of open ports as security vulnerabilities in common user computers. In Computational Science and Technology (ICCST), 2014 International Conference on (pp. 1-6). IEEE.

Mccarrollnet. (2014). Getting started with PySpark. Installing Spark on a Hadoop cluster [Online]. Available:http://www.mccarroll.net　/blog/pyspark/ [2014, March 2].

NYU Wikis. (2017). Service Offerings. Big Data Hadoop Architecture [Online].Available:https://wikis.nyu.edu/display/NYUHPC/Big+Data+Tutorial+1%3A+MapReduce [2017, April 12].

Santos, M.C., Meira, W., Guedes, D., & Almeida, V. F. (2016, May). Faster: a low overhead framework for massive data analysis. In Cluster, Cloud and Grid Computing (CCGrid), 2016 16th IEEE/ACM International Symposium on (pp. 311-320). IEEE.



Wang, X., Zheng, K., Niu, X., Wu, B., & Wu, C. (2016, May). Detection of command and control in advanced persistent threat based on independent access. In Communications (ICC), 2016 IEEE International Conference on (pp. 1-6). IEEE.


Xiaoqing, G., Hebin, G., & Luyi, C. (2010, April). Network intrusion detection method based on Agent and SVM. In Information Management and Engineering (ICIME), 2010 The 2nd IEEE International Conference on (pp. 399-402). IEEE.