臺灣博碩士論文加值系統

在這個網路攻擊日益興盛的資訊年代，防火牆、入侵偵測系統、入侵預防系統等防禦性軟硬體產品也逐年增加，舉凡Amazon的CloudFront、Web Application Firewall著名的ModSecurity等都是類似概念下衍伸出的產品。但這些防禦性產品都容易出現安全盲點，舉例像大部分入侵偵測系統在偵測到攻擊流量特徵時，會採取阻擋IP位址的黑名單方法來防禦攻擊者，但這類方法治標不治本，並沒有真正解決系統問題，也容易使系統網管陷入自以為安全的誤區。
在本篇論文中，我們將提出一種較前人方法更佳的系統測試框架，能夠針對前面提到的黑名單機制的防禦性產品做一個全面性的檢測，期望能解決前面所提的安全盲點問題。我們透過雲端分散式的架構來將測試流量分散，其既可以混淆偵測機制，也可以躲避黑名單阻擋機制，並且對測試速度來說有顯著的提升。而此種方法，不僅可以視為資訊安全專家、公司企業一個自我檢測設備防禦程度的工具，也能給防禦性產品開發人員當作一個測試指標。
在過去的方法中，普遍是以單純規則層面上的手法去試著繞過這類安全性產品的黑名單阻擋機制。或者是以少量預先開好抑或是原本自身就擁有多台機器的條件上，去對安全性產品做單一類別的掃描、測試。這些條件對於一般小型公司或資訊安全研究員來說，並不是一個很完善的好方法，故此篇論文主要的貢獻在於：第一、提出一個自動化的開關機器方法 (Auto-scaling)，第二、不僅僅局限於單一類別的掃描、測試，而是支援多種類型的常見掃描、測試方法，第三、提出一種高效率、低支出的演算法，能夠在較短時間內完成任務，降低金錢與時間成本。

In this Internet era, cyber attacks happen every second. The safety of network environments rely more and more on firewalls, intrusion prevention systems and intrusion detection systems. Noteable products include Amazon’s CloudFront and the popular Web Application Firewall product ModSecurity. These defense products usually have some security blind spots. When they detect malicious requests, they often directly block the source IP address to prevent further attacks. Such a method is not the best way for defensing cyber attack, because the attacker might be able to bypass the above defense systems.
In this thesis, we will introduce a better system testing method and implement a testing framework for detecting previous blacklist bypassing problems. It will use a better scanning method to test the IP-based blacklist defense products, and this framework will automatically create lots of cloud instances to dodge the detection from Amazon EC2 or Google GCP, and so on. This method can confuse a WAF/IDS detection mechanism and it can speed up the scanning time and promote the coverage rate.
In the past, researchers usually use rule-based methods to bypass a WAF/IDS detection mechanism. But when WAF/IDS rules become stronger, these methods will become useless for pentesters or researchers. As many companies do not have enough resources to build a huge testing environment to test their products, our goal is to introduce a frugal and faster method and algorithm to find vulnerabilities in their products.

致謝
摘要
ABSTRACT
目錄
圖目錄
第1章. 緒論……………………………………………………………………1
1.1 前言 ………………………………………………………………...….1
1.2 研究動機與目的……………………………………………………....2
1.3 相關研究………………………………………………………………3
第2章. 網頁應用防火牆與入侵防禦系統…………………………………….5
2.1 防禦系統簡介………………………………………………………...5
2.2 黑名單防禦…………………………………………………………...6
2.3 白名單防禦…………………………………………………………...9
2.4 規則式防禦………………………………………………………….10
2.5 主流防禦軟體概述………………………………………………….12
第3章 雲端計算 (Cloud Computing)……………………………………….15
3.1 雲端服務概述………………………………………………………..15
3.2 Amazon Web Service………………………………………………...16
3.3 Google Compute Platform ……………………………………….......20
第4章 掃描演算法…………………………………………………………..25
4.1 弱點掃描概述………………………………………………………..25
4.2 端口掃描……………………………………………………………..25
4.3 路徑掃描……………………………………………………………..27
4.4 域名掃描……………………………………………………………..29
4.5 參數模糊測試………………………………………………………..33
第5章 模組實作……………………………………………………………..35
5.1 Web Application Firewall指紋辨識………………………………...36
5.2 訊息交換協議……………………………………………………….38
5.3 端口掃描實作……………………………………………………….40
5.4 路徑掃描實作……………………………………………………….42
5.5 子域名掃描實作…………………………………………………….46
5.6 接收端實作………………………………………………………….48
第6章 實驗結果與效能比較………………………………………………..50
6.1 測試之結果………………………………………………………….50
6.2 金錢成本分析……………………………………………………….61
第7章 結論與未來展望……………………………………………………..64
7.1 結論………………………………………………………………….64
7.2 未來研究方向……………………………………………………….64
參考文獻………………………………………………………………………..66

[1] Prachi Deshpande, Aditi Aggarwal, S.C.Sharma, P.Sateesh Kumar, Ajith Abraham, “Distributed Port-Scan Attack in Cloud Environment”, 2013 Fifth International Conference on Computational Aspects of Social Networks, 12-14 Aug. 2013.
[2] Damien Riquet, Gilles Grimaud, Michaël Hauspie, “Large-Scale Coordinated attacks: Impact on the Cloud Security”, International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, 4-6 July 2012.
[3] Preeti Mishra, Vijay Varadharajan, Uday Tupakula, Emmanuel S. Pilli, “A Detailed Investigation and Analysis of Using Machine Learning Techniques for Intrusion Detection”, IEEE Communications Surveys & Tutorials, Vol. 21, pp. 686-728, 15 June 2018.
[4] P.Deshpande, S. Sharrna, P. Kumar, “Deployment of Private Cloud: Go Through the Errors First” Proc. of Conference on Advances in Communication and Control Systems 2013 (CAC2S 2013), Deharadun-India, Apr. 2013, pp. 638-641.
[5] Mingphum Arunwan, Tanachad Laong, Kiattichai Atthayuwat, “Defensive Performance Comparison of Firewall Systems”, 2016 Management and Innovation Technology International Conference (MITicon), 12-14 Oct. 2016.
[6] Sajad Shirali-Shahreza, Yashar Ganjali, “Protecting Home User Devices with an SDN-Based Firewall”, IEEE Transactions on Consumer Electronics, Vol. 64, pp. 92-100, Feb. 2018.
[7] Mauro Soria, Retrived June 25,2019,from https://github.com/maurosoria/dirsearch
[8] Sandro Gauci, Retrived June 25, 2019, from github.com/EnableSecurity/wafw00f
[9] Gordon Lyon, Retrived June 25, 2019, from https://nmap.org
[10] Guillaume Savary, Retrived June 25, 2019, from TCP series #1, https://accedian.com/enterprises/blog/diagnose-tcp-connection-setup-issues/
[11] Isabell Schmitt, Sebastian Schinzel, “WAFFle: Fingerprinting Filter Rules of Web Application Firewalls”, WOOT''12 Proceedings of the 6th USENIX conference on Offensive, August 8–12, 2011.
[12] Wei Zhang, Shaohua Teng, Xiufen Fu, “Scan Attack Detection Based on Distributed Cooperative Model”, 2008 12th International Conference on Computer Supported Cooperative Work in Design, 16-18 April 2008.
[13] lijiejie,Retrived June 26,2019,from www.lijiejie.com/iis-win8-3-shortname-brute
[14] B. Prabadevi, N. Jeyanthi, “Distributed Denial of Service Attacks and its Effects on Cloud Environment”, The 2014 International Symposium on Networks, Computers and Communications, 28 July 2014.
[15] Zohaib Hassan, Shahzeb, Roman Odarchenko, Sergiy Gnatyuk, Abnash Zaman, Masroor Shah, “Detection of Distributed Denial of Service Attacks Using Snort Rules in Cloud Computing & Remote Control Systems”, 2018 IEEE 5th International Conference on Methods and Systems of Navigation and Motion Control (MSNMC), 16-18 Oct. 2018.
[16] Opeyemi Osanaiye, Kim-Kwang Raymond Choo, Mqhele Dlodlo, "Distributed Denial of Service (DDoS) Resilience in Cloud: Review and Conceptual Cloud DDoS Mitigation Framework", Journal of Network and Computer Applications, vol. 67, pp. 147, 2016.
[17] Amazon Web Services, Inc, Retrived June 26, 2019, from https://docs.aws.amazon.com/zh_tw/waf/latest/developerguide/tutorials-4xx-blocking.html
[18] Sung-Hwan Ahn, Nam-Uk Kim, Tai-Myoung Chung, “Big Data Analysis System Concept for Detecting Unknown Attacks”, 16th International Conference on Advanced Communication Technology, 16-19 Feb. 2014.
[19] Siti Hawa Mokhtar, Gopinath Muruti, Zul-Azri Ibrahim, Fiza Abdul Rahim, Hairoladenan Kasim, "A Review of Evidence Extraction Techniques in Big Data Environment", Smart Computing and Electronic Enterprise (ICSCEE) 2018 International Conference on, pp. 1-7, 2018.
[20] M. Mazhar Rathore, Faisal Saeed, Abdul Rehman, Anand Paul, Alfred Daniel, "Intrusion Detection using Decision Tree Model in High-Speed Environment", Soft-computing and Network Security (ICSNS) 2018 International Conference on, pp. 1-4, 2018.