A Learning Based Illegal Access Detection and Prevention System for Next Generation Network

近年来，基于网络的入侵检测系统在网络安全系统中发挥了重要作用。然而，网络入侵检测系统中使用的模式匹配技术对新型病毒或未经授权的访问、故意规避行为的能力较弱，对于配备加密的下一代互联网协议IPv6来说是不可取的。在本研究中，我们提出了一种新的具有子网络学习功能的访问检测系统。我们的目标是开发下一代接入检测系统，包括未知的非法访问检测结构，与网络入侵检测系统合作，适应IPv6。在本研究中，我们讨论了模式匹配技术中难以检测到的拒绝服务(DoS)攻击，并开发了学习和检测DoS攻击的系统。该系统利用正常访问遵循TCP拥塞避免机制，并将测试反馈发送给怀疑未经授权访问的来源，以降低传输速率。通过检测源的响应，判断其是否是非法访问，并开发了在子网络入侵检测系统和相邻网络入侵检测系统之间共享检测到的非法访问信息所需的软件。该软件实现了对非法访问的广泛拦截，并结合检测系统构建了非法访问检测与消灭系统。我们在真实的网络上进行了实验。实验结果表明，该检测系统能够快速、准确地检测到攻击，实现了高检测率和低漏检率。

Recently, NIDS (Network-based Intrusion Detection System) has played an important role in Internet security system. However, the pattern matching technique used in NIDS is weak for new-type virus or unauthorized access, intentionally evasion act and is not expectable for next generation internet protocol IPv6 equipped with encryption. In this study, we propose a new access detection system which have learning function on subnetwork. Our goal is to develop next generation access detection system which include unknown illegal access detection structure, cooperate with NIDS and adapt to IPv6.In this research, we discussed about DoS (Denial of Service) attack that is difficult to detect in pattern matching technique and developed the system that learn and detect DoS attack This system exploit that the normal access follows the TCP congestion avoidance mechanism and will send test feedback to the source that being suspected of unauthorized access to decrease the transmission rate. By detecting the source's response, we can determine whether it is unauthorized access or not.Furthermore, we develop the software necessary for sharing information of detected unauthorized access among subnet NIDS and neighboring NIDS. This software makes it possible to block the unauthorized access extensively and we construct unauthorized access detection and extermination system combined with detection system. We had performed experiments over real network. As a result, we verified that detection-system is able to detect attack rapidly and accurately and we can realize high detection rate and low false negative rate.