Ma0k0205

1.1

1.2.3.4.5.1.2

2.1

Host base

Network base

2.1.1 Host base

2.1.2 Network base

On lineOff line2.1.2.1 On line

:

:2.1.2.1 On line

:2.1.2.2 Off line

:1.2.:1.2.2.1.2.2 Off line2.2 UNIX

UNIXsyslogd

Syslogd

2.2.1 http_access_logIPGETPOSTHEADWEBprotocolHTTP/1.0 HTTP/1.1URL

2.2.2 sshd_logsshdsshdsshdsshd

pid Accepted passwordFailed password

sshd sshd2.2.3 iptables_log

2.2.4 mail_logmail_log

2.3

2.4 2.4.1 Fuzzy2.4.2 Neural Network2.4.3 SVM2.4.4 Automata2.4.5 empirical2.5 Log 2.5.1 (Denial of Service, DoS)Land Teardrop SYN Flood UDP Flood (Fraggle )Smurf

(Distributed Denial of ServiceDDoS)2.5.2 LogApache severaccess_logiptablesmail severmaillogsshsshd

Example:SlapperCode Red

3.1.1

3.1.1.1

3.1.2

3.1.2.1 (pattern match)

3-1-6 Code Red3.1.2.1 (pattern match) 3-1-7 Code Red

3.1.2.2 (abnormal behavior analysis)

3-1-8 3.1.2.2 (abnormal behavior analysis) 3-1-9

3.1.2.2 (abnormal behavior analysis) 3-1-10

= 1 / (-) * (-)3.1.2.3 (abnormal user log trace)3.1.3

3-1-11 3.1.3.1 log table1. http_access_log id bigserial NOT NULL userIP inet IPuserid character(80) IDaccessTime integer httpCommand character(1000) http statusCode integer size integer Refer character(255) userAgent character(255) uploadIP inet IPuploadTime integer 3.1.3.1 log tablehttp_access_logsshd_logiptables_logmail_log3.1.3.2 pattern table id bigserial NOT NULL pid character(80) ps character(80) name character(255)fname character(255) pattern character(1000)infor character(255) url character(255) 3.1.3.3 behavior table id bigserial NOT NULL b_pid integerps character(80) name character(255) threshold Time integer -fname character(255) Patterncharacter(1000) infor character(255) url character(255) 3.1.4

3.1.4.1 3.1.4.2 3.2 3.2.1 1.

2.

3.

4.3.2 3.2.1 5.

6.

7.3.2 3.2.2

3.3 3.3.1 Example:3.3 3.3.2 http_access_log sshd_loghttp_access_log IP sshd_log sshd 4.1 4.1.1 4.1.1.1 Code Red

4-1 Code Red4.1.1.2 Slapper

4-2 Slapper4.1.2 4.1.2.1 Unauthorized

http_access_log 4.1.2 4.1.2.2 Failed_password

sshd 4.1.2 4.1.2.3 Try_account Try_account

4.1.3

4.2

4-7