Developing Security-Enhanced Model for Enterprise Network ﻟﻟﺷﺑﮐﺎت
Total Page：16
File Type：pdf, Size：1020Kb
Computer Engineering Department Faculty of Engineering Deanery of Higher Studies Islamic University – Gaza Palestine Developing Security-Enhanced Model For Enterprise Network تطوير نموذج آمن للشبكات المؤسساتية By Khaled W. Alnaji Supervisor Dr. Aiman Abu Samra A Thesis Submitted in Partial Fulfillment of the Requirements for the Degree of Master of Science in Computer Engineering 1435H (2014) Dedication To my beloved father Waleed To my beloved mother Sawsan To my beloved wife Manar To my sister Yasmin To my brothers Mohamed, Abedalhadi, and Rashad To my daughters Sawsan and Yara To my son Waleed iii Acknowledgment Praise is to Allah, the Almighty for having guided me at every stage of my life. I would like to express my special appreciation and thanks to my advisor Dr. Aiman Abu Samra, for his guidance, support, motivation, enthusiasm, and immense knowledge during working on my thesis. I would like to thank you for encouraging my research and for allowing me to grow as a research scientist. I would also like to thank Dr. Hasan Qunoo, your guidance helped me in all the time of research and writing of this thesis. Continuing my thanks to thesis committee, both Dr. Yousuf Abu Shaaban and Dr. Hasan Qunoo for their suggestions and recommendations which assisted in developing this research. A special thanks to my family. Words cannot express how grateful I am to my father, my mother, for all of the sacrifices that you’ve made on my behalf. Your prayer for me was what sustained me thus far. I would also like to thank all of my friends who supported me in writing, and incented me to strive towards my goal. At the end I would like express appreciation to my beloved wife who spent sleepless nights with and was always my support in the moments when there was no one to answer my queries. iv TABLE OF CONTENTS LIST OF FIGURES .............................................................................................................................. VII LIST OF TABLES ................................................................................................................................. IX X ...................................................................................................................................................... ملخص ABSTRACT ........................................................................................................................................... XI CHAPTER 1: INTRODUCTION ........................................................................................................... 1 1.1 ENTERPRISE NETWORK .......................................................................................................................... 1 1.2 NETWORK SECURITY AND SECURITY MODEL ........................................................................................ 4 1.3 OUR CONTRIBUTION .............................................................................................................................. 7 1.4 THESIS STRUCTURE................................................................................................................................ 7 CHAPTER 2: RELATED WORK ......................................................................................................... 9 CHAPTER 3: ENTERPRISE NETWORK MODEL ENM ................................................................. 23 3.1 BASIC CONCEPTS RELATED TO ENTERPRISE NETWORK MODEL:......................................................... 23 3.2 ENTERPRISE NETWORK MODEL SERVICES ........................................................................................... 29 3.3 ENTERPRISE NETWORK MODEL REQUIREMENTS AND DIFFICULTIES ................................................... 29 3.3.1 Enterprise Network Model Requirements .................................................................................... 30 3.3.2 Difficulties In Applying ENM Requirements: .............................................................................. 34 3.4 THREATS ON ENTERPRISE NETWORK MODEL ...................................................................................... 36 3.5 ENTERPRISE NETWORK MODEL TOPOLOGY ......................................................................................... 37 3.6 SUMMARY ............................................................................................................................................ 41 CHAPTER 4: SECURITY ENHANCED MODEL FOR ENM ........................................................... 43 4.1 OUR PROPOSED SECURITY-ENHANCED MODEL ................................................................................... 43 4.1.1 Security-Enhanced Model Components ....................................................................................... 43 4.1.2 Techniques And Tools Used In Security-Enhanced Model .......................................................... 47 4.2 TRAFFIC ANALYSIS OF ENTERPRISE NETWORK MODEL ...................................................................... 51 4.2.1 Common Traffic Analysis Tools ................................................................................................... 52 4.2.2 Configuring NetFlow Export On Network Devices ..................................................................... 54 4.3 NETWORK TRAFFIC ANALYSIS ............................................................................................................. 54 4.4 DEEP ANALYSIS OF HTTP/HTTPS TRAFFIC ....................................................................................... 62 4.5 INTRUSION DETECTION SYSTEM (IDS) AND INTRUSION PREVENTION SYSTEM (IPS) .......................... 65 4.6 ADVANCED PERSISTENT THREAT (APT) .............................................................................................. 66 4.6.1 Operation Aurora ........................................................................................................................ 66 4.7 AURORA ATTACK PREVENTION USING OUR PROPOSED SECURITY-ENHANCED MODEL ...................... 68 4.8 SUMMARY ............................................................................................................................................ 70 CHAPTER 5: IMPLEMENTATION AND EVALUATION ............................................................... 72 5.1 DEVICES AND TOOLS ........................................................................................................................... 72 v 5.2IMPLEMENTATION ................................................................................................................................. 74 5.2.1 Implementing Firewall With Integrated IPS ................................................................................ 74 5.2.2Implementing SNORT As Network Intrusion Detection System (NIDS) ....................................... 75 5.2.3Implementing OSSEC As Host Intrusions Prevention System (HIPS) .......................................... 79 5.2.4 Implementing Splunk As Log Manager And Analyzer ................................................................. 84 5.3 EVALUATION ....................................................................................................................................... 87 5.3.1 Defense Evaluation ...................................................................................................................... 87 5.3.2 Performance Evaluation .............................................................................................................. 88 CHAPTER 6: CONCLUSION AND FUTURE WORK ...................................................................... 92 6.1 CONCLUSION........................................................................................................................................ 92 6.2 FUTURE WORK .................................................................................................................................... 94 APPENDICES ...................................................................................................................................... 95 APPENDIX A .............................................................................................................................................. 95 APPENDIX B ............................................................................................................................................... 97 APPENDIX C ............................................................................................................................................... 98 APPENDIX D .............................................................................................................................................. 99 REFERENCES ................................................................................................................................... 120 vi List Of Figures Figure 2.1: Components of P2DWR2 model. ................................................................... 10 Figure 2.2: The proposed model WP2DR2C. ................................................................... 11 Figure 2.3: NIPS gateway of proposed model WP2DR2C. .............................................. 11 Figure 2.4: The hardware structure of proposed detection system using embed processor. ........................................................................................................................................... 12 Figure 2.5: Software structure of proposed detection system using embed processor. .... 13 Figure 2.6: The proposed network security