Abstract
This thesis discusses a modified Union Defense System. The main purpose of the Union Defense System is to unite the known IDSs on the network. A designated Global Policy Server is used to collect and analyze the events from all IDSs, once a DDoS attack is detected, the Global Policy Server will inform the IDSs and then block the attack. In the original design, the signature used by Global Policy Server to detect is fixed. Although the administrator of the system can adjust the parameters of the signature to fit the status of the network, but it still has drawbacks to confront the highly changeable network. If an aggressor happens to know the signature and the parameters, he will be able to send out a specially designed attack to avoid the detection of the Global Policy Server. We purpose a modification to overcome the leak point. We use a well-developed technology, Datamining, to produce the signature for the use of the Union Defense System. First, some labeling and standardization processes are applied to the event logs from IDSs, and the preprocessed data will be feed into some Datamining tools. Thus the knowledge mined by the tools, will be used by Global Policy Server to detect DDoS attack. Since the information is mined from the same sort of data, the detection rate will be better than the original one. We also develop a prototype of the system. And three Datamining tools are introduced to have some comparison and to exam the correctness of the framework.