认识网路安全与异常侦测.ppt

認識網路安全與異常偵測 中央大學 電算中心 楊素秋 96年 11月 13日 報告大綱 1. 網路安全問題 Viruses, Worms, Dos attack 2.網路安全因應對策 Customer-based countermeasures ISP-based countermeasures 3. Detection Notification System End-based, LAN-based, WAN-based (ISP) 4. 結語 1. 網路安全問題 網路安全的挑戰 Viruses Large amount of program replication Ｍail virus Attached in email Infect system by enduring user clicking the attached Resend large amount of mail virus Self-propagating programs, … Spread through toxic web page browsing 1.網路安全問題(cont.) Worms Self-propagating programs spread over Internet Spread by scanning the network for vulnerable machines infecting them Evolution of network worms Spread through system vulnerability CoRed (Jul 2001) Spread through system vulnerability tftpd Nimda, Nachi (Sep 2001) Spread through system vulnerability mail virus SoBig ( Aug 2003), MyDoom(jan 2004),Bagle (2004) Spread through system vulnerability Toxic webs Stanty (Dec 2004) 1.網路安全問題(cont.) BotNet Zombie army Distributed through Irc (network chat room) 6667/tcp Dos attack Slam well known web server (MicroSofts, Google, …) Flooding-based DDoS attack Significant performance decline of network link Identification thief Spyware, Phishing (banks, ebay, paypal, … 1.網路安全問題(cont.) Technical Hackers Show their skill Technical Hackers + Criminal gang Enormous profits The weak link in Internet Security A significant population of Internet users are not adequately secure their desktops 2.網路安全因應對策 Where security countermeasures could be invoked Customer-based countermeasures ISP-based countermeasures** ISP core/edge/access routers 2.網路安全因應對策(cont.) Customer-based countermeasures Anti-virus software Firewall, IDS OS Vender s/w patch Windows Update Linux Up2date S/W Vender’s Security Improvements Desktop Vulnerability Checking Firewall == Secure ?? (Incorrect) 2.網路安全因應對策(cont.) Why ISP’s are uniquely positioned to help John E.H. Clark (Feb 2003) Traffic gateway All traffic bw. Internet the customer’s desktop passes through ISP’