Review of KIISC (정보보호학회지)

Korea Institute of Information Security and Cryptology (한국정보보호학회)
권호 표지

비정상 트래픽 공격 유형 분석

  • 전용희 (대구가톨릭대학교 컴퓨터정보통신공학부) ;
  • 장종수 (한국전자통신연구원 정보보호연구단 보안응용그룹)
  • Published : 2007.04.30
Download PDF
⟨ Previous Next ⟩

Abstract

네트워크 트래픽에서 비정상(anomaly)을 탐지하는 것은 아주 중요하지만 아직 완전히 해결되지 않은 문제이다. 비정상 유형을 관찰하기 위하여 일반적으로 트래픽 플로(traffic flow)를 감시한다. 트래픽 플로는 여러 가지 네트워크 트래픽의 형태를 제시한다. 이런 트래픽 플로의 집합에 대한 분석은 매우 복잡한 문제이고, 또한 트래픽 플로 수집을 위해서는 많은 자원이 소요된다. 본 논문에서는 비정상 트래픽 유형을 공격 형태 및 트래픽 플로 두 가지의 다른 측면에서 제시하고 그 특성을 기술한다. 그리고 앞으로 나타날 새로운 웜 공격 유형에 대하여도 제시한다.

Keywords

References

  1. Anukool Lakhina, Mark Crovella, and Christophe Diot, 'Diagnosing Network-Wide Traffic Anomalies', SIGCOMM'04, Aug. 30-Sep.3, 2004. Portland, Oregon, USA
  2. A. Lakhina, M. Crovella, and C. Diot, 'Characterization of Network-Wide Anomalies in Traffic Flows', IMC '04, Taormina, Sicily, Italy, Oct. 2004
  3. Howard F. Lipson, Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues. Technical report, CERT Coordination Center, Nov. 2002
  4. Simon Hansman, A Taxonomy of Network and Computer Attack Methodologies, University of Canterbury, New Zealand, Nov. 2003
  5. V. Yegneswaran, P. Barford, and J. Ullrich, 'Internet Intrusions: Global Characteristics and Prevalence', In ACM SIGMETRICS, San Diego, June 2003
  6. A. Markopoulou, G. Iannaccone, S. Bhattacharyya, C.-N. Chuah, and C. Diot, 'Characterization of Failures in an IP Backbone', In IEEE INFOCOM, Hong Kong, April 2004
  7. N. Weaver. Warhol Worms: The Potential for Very Fast Internet Plagues, http://www.cs.berkeley.edu/~nweaver/warhol. htmI
  8. A. Hussain, J. Heidemann, and C. Papadopoulos, 'A Framework for Classifying Denial of Service Attacks', In ACM SIGCOMM, Karlsruhe, Aug. 2003
  9. J. Mirkovie and P. Reiher, 'A Taxonomy of DDoS Attacks and Defense Mechanisms', ACM CCR, April 2004
  10. P. Barford, J. Kline, D. Plonka, and A. Ron, 'A Signal Analysis of Network Traffic Anomalies', In Internet Measurement Workshop, Marseille, Nov. 2002
  11. N. Duffield, C. Lund, and M. Thorup, 'Estimating Flow Distributions from Sampled Flow Statistics', In ACM SIGCOMM, Karlsruhe, Aug. 2003
  12. J. Jung, B. Krishnamurthy and M. Rabinovich, Flash Crowds and Denial of Service Attacks: Characterization and Implications for CDNs and Web Sites. In World Wide Web Conference, Hawaii, May 2002
  13. Glenn Gebhart, Worm Propagation and Countermeasures, SANS Institute, 2004
  14. Internet Security Systems, ISS Security Advisory: 'Snork' Denial of Service Attack Against Windows NT RPC Service. 1998. http://xforce.iss.net/xforce/alerts/id/advise9
  15. Ed Skoudis and Lenny Zeltser, Malware: Fighting Malicious Code, Prentice-Hall, 2004, (Chapter 2: Virus, 3: Worm)
  16. Xuan Chen and John Heidemann, Detecting Early Worm Propagation through Packet Matching, Technical Report ISI-TR-2004-585, 2004
  17. Jing Yang, 'Fast Worm Propagation in IPv6 Networks'