移动自组织网中基于统计异常的入侵检测和响应系统研究

发布时间：2018-08-03 09:13

【摘要】：移动自组织网络(MANET)作为传统有线和固定无线网络的一种自然延伸,形成了一个混合的无线多跳网络。其最初被开发用于军事应用中,现已被广泛应用于大部分民用领域。通过支持灵活和自适应的应用程序,不依赖固定基础设施等特性,移动自组织网络预计在未来将发挥越发重要的作用。然而,其中存在的安全问题对系统和协议的正常运行产生了重要影响,MANET基本职能的安全性受到了严重干扰。移动自组网,在其顶层设计上,同传统有线和固定设施无线网络类似,需要同样的安全需求,如认证,机密性,完整性和可用性等。然而,由于其特有的特性,现有针对有线和固定无线网络的安全机制已不再适合MANET中存在的网络模型攻击防护。近来,为弥补现有安全措施的局限和不足,入侵检测系统(I[DS)技术的研究变得逐步深入,并成为了补充传统安全机制的第二道防线。在本研究中,我们研究基于统计异常的技术来构建适合MANET的入侵检测方案。在进行细致分析的基础上,设计提出了基于统计技术的安全方案来检测针对MANET的路由攻击。该检测方案利用路径的特点来评估由其他检测者提供的全局可信度。此外,我们设计了针对攻击的响应机制,以减轻所发生攻击的潜在影响。具体地,我们在响应机制设计中,充分利用了信誉机制来对攻击指控记录中的节点行为做出判定。本研究提出了攻击检测和响应方案来构建基于统计异常的分布式合作入侵检测和反应系统(SAIDRS).我们通过模拟实验评估了SAIDRS的良好性能。不同的移动模式和攻击场景模拟评估结果表明,SAIDRS能实现针对路由攻击的良好检测和及时响应,以及网络吞吐量的较好改善。
[Abstract]:As a natural extension of traditional wired and fixed wireless networks, mobile ad hoc networks (MANET) form a hybrid wireless multi-hop network. Initially developed for military applications, it has been widely used in most civilian applications. Mobile ad hoc networks are expected to play an increasingly important role in the future by supporting flexible and adaptive applications without relying on features such as fixed infrastructure. However, the existing security problems have an important impact on the security of the basic functions of Manet due to the normal operation of the system and protocols. Mobile ad hoc networks require the same security requirements such as authentication confidentiality integrity and availability similar to traditional wired and fixed-facility wireless networks in their top-level design. However, due to its unique characteristics, the existing security mechanisms for wired and fixed wireless networks are no longer suitable for network model attack protection in MANET. Recently, in order to make up for the limitations and shortcomings of the existing security measures, the research of intrusion Detection system (I [DS) technology has gradually deepened and become the second line of defense to supplement the traditional security mechanism. In this study, we study the technique of statistical anomaly to construct the intrusion detection scheme suitable for MANET. On the basis of detailed analysis, a security scheme based on statistical technology is proposed to detect routing attacks against MANET. The detection scheme utilizes the characteristics of the path to evaluate the global reliability provided by other detectors. In addition, we designed a response mechanism to mitigate the potential impact of attacks. Specifically, in the design of response mechanism, we make full use of the reputation mechanism to judge the node behavior in the record of attack allegations. This paper proposes an attack detection and response scheme to construct a distributed cooperative intrusion detection and response system (SAIDRS).) based on statistical anomaly. We evaluated the good performance of SAIDRS by simulation experiments. The simulation results of different mobile modes and attack scenarios show that SAIDRS can detect and respond to routing attacks in good time and improve network throughput.
【学位授予单位】：中国科学技术大学
【学位级别】：博士
【学位授予年份】：2014
【分类号】：TN929.5

【共引文献】