A Learning Based Illegal Access Detection and Prevention System for Next Generation Network

近年来，基于网络的入侵检测系统（NIDS）在网络安全体系中扮演着重要的角色。然而，NIDS所采用的模式匹配技术对于新型病毒或非授权访问、故意规避行为的检测能力较弱，对于下一代IPv6加密网络也不适用。在本研究中，我们提出一个新的具有学习功能的子网路存取侦测系统。我们的目标是开发出一个包含未知非法访问检测结构、与NIDS协同工作、适应IPv6的下一代访问检测系统。我们讨论了DoS（拒绝服务）针对模式匹配技术中难以检测到的拒绝服务攻击，开发了学习和检测拒绝服务攻击的系统。该系统利用正常访问遵循TCP拥塞避免机制，并将发送测试向被怀疑未经授权访问的源反馈以降低传输速率。通过检测源的响应，我们可以确定它是否是未经授权的访问或没有。此外，我们开发了必要的软件，共享子网NIDS和邻居NIDS之间的检测到的未经授权的访问信息。该软件使得大范围的拦截非法访问成为可能，并结合检测系统构建了非法访问检测和查杀系统。我们在真实的网络上进行了实验。实验结果表明，该检测系统能够快速、准确地检测出攻击，实现了高检测率和低漏报率。

Recently, NIDS (Network-based Intrusion Detection System) has played an important role in Internet security system. However, the pattern matching technique used in NIDS is weak for new-type virus or unauthorized access, intentionally evasion act and is not expectable for next generation internet protocol IPv6 equipped with encryption. In this study, we propose a new access detection system which have learning function on subnetwork. Our goal is to develop next generation access detection system which include unknown illegal access detection structure, cooperate with NIDS and adapt to IPv6.In this research, we discussed about DoS (Denial of Service) attack that is difficult to detect in pattern matching technique and developed the system that learn and detect DoS attack This system exploit that the normal access follows the TCP congestion avoidance mechanism and will send test feedback to the source that being suspected of unauthorized access to decrease the transmission rate. By detecting the source's response, we can determine whether it is unauthorized access or not.Furthermore, we develop the software necessary for sharing information of detected unauthorized access among subnet NIDS and neighboring NIDS. This software makes it possible to block the unauthorized access extensively and we construct unauthorized access detection and extermination system combined with detection system. We had performed experiments over real network. As a result, we verified that detection-system is able to detect attack rapidly and accurately and we can realize high detection rate and low false negative rate.