物理隔离网络攻击的入侵检测算法

发布时间：2018-10-26 13:46

【摘要】：随着网络防御技术的不断发展,网络攻击技术也在不断升级。一方面,不断涌现出已知攻击类型的变种使得传统的入侵检测系统(IDS)难以发现;另一方面,近三年来更是出现了一些被传统网络安全观视为不可能实施的攻击技术。在新型网络攻击下,物理隔离网络中计算机系统不再安全。目前已有一些技术手段允许攻击者从物理隔离计算机中窃取信息。从最新的文献来看,此类攻击已经发展到可利用设备发热量、电磁波、声波等技术手段来窃取物理隔离目标计算机中的数据。GSMem攻击是一种利用电磁波技术对物理隔离网络中计算机攻击的新型分布式恶意程序,如何对此攻击实施检测,这是本文拟研究解决的问题。为此,本文从GSMem攻击模型中发射器组件的最本质特点出发,提出了针对GSMem攻击的入侵检测算法。算法从发射器组件调制发射电磁信号的核心原理入手,首先检测内存中是否存在线程按照“B-ASK”(两级振幅键控的变体)信号调制的方式周期性的调用单指令多数据指令集中MOVNTDQ指令;当存在这样的线程之后,再按照“B-ASK”调制原理,把时间“T”逐一划分进行循环,每次循环生成二进制字符串与计算机中需要保护的高敏感信息的二进制形式字符串逐一进行匹配,最后根据匹配的结果来判断是否发生了GSMem攻击。实验结果证实,新算法能有效检测针对物理隔离网络中计算机的GSMem攻击;复杂度分析结果则表明,新算法可在多项式时间内实施上述检测。从已有的文献来看,目前未见关于物理隔离网络攻击检测文献的相关报道,而本文正是针对此类攻击选取GSMem攻击实施检测。这是本文的主要贡献。本工作得到了国家重点研发计划项目(2016YFB0800100)、国家自然科学基金项目(61572444、U1204608)与中国博士后科学基金项目(2012M511588、2015M572120)的资助。
[Abstract]:With the continuous development of network defense technology, network attack technology is also constantly upgrading. On the one hand, the variety of known attack types is constantly emerging, which makes the traditional intrusion detection system (IDS) difficult to find. On the other hand, in the last three years, some attack technologies which are regarded as impossible by the traditional network security concept have emerged. Under the new network attack, the computer system in the physical isolation network is no longer secure. There are some techniques that allow attackers to steal information from physically isolated computers. From the latest literature, such attacks have evolved to make use of equipment to generate heat, electromagnetic waves, GSMem attack is a new distributed malicious program that uses electromagnetic wave technology to attack computer in physical isolation network. How to detect this attack, This is the problem to be solved in this paper. Therefore, based on the essential characteristics of emitter components in the GSMem attack model, an intrusion detection algorithm for GSMem attacks is proposed in this paper. The algorithm starts with the core principle of transmitter component modulating and transmitting electromagnetic signal. First, it detects whether there is a thread in memory that modulates MOVNTDQ instruction periodically in single instruction multiple data instruction set according to "B-ASK" (two-stage amplitude keying variant) signal modulation. When such a thread exists, the time "T" is divided one by one into loops according to the "B-ASK" modulation principle. Each time the binary string is generated and matched one by one with the binary string of the highly sensitive information needed to be protected in the computer. Finally, the GSMem attack is judged according to the matching result. The experimental results show that the new algorithm can effectively detect the GSMem attacks against computers in the physical isolation network, and the complexity analysis results show that the new algorithm can implement the above detection in polynomial time. From the existing literature, there are no reports on the physical isolation network attack detection literature, and this paper selects GSMem attacks to carry out detection for such attacks. This is the main contribution of this paper. This work is supported by the National key R & D Program (2016YFB0800100), the National Natural Science Foundation (61572444U U1204608) and the China Post-doctoral Science Foundation (2012M511588 / 2015M572120).
【学位授予单位】：郑州大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】