untitled

Size: px

Start display at page:

Download "untitled"

あおいのじま
4 years ago
Views:

2 SIDA IODEF RECEIVER / ARCHIVER SIDA IODEF GENERATOR MANUAL AUTHORING IODEF SENDER IODEF RECEIVER / ARCHIVER IODEF ANALYZER IODEF RIDSERVER IODEF WIDE AREATRACKER... 15

3 Sida IODEF Receiver / Archiver PostgreSQL Data Server 8.0 config/alertreceiver.conf SNMPPORT162 - SNMP Trap/Notification Snort DATA_DIRdata/DATABASE Snort DATABASEtrue DB config/db.properties HOSTIPPostgreSQL DBPORT5432 PostgreSQL DATABASEsidaAlertDB DB USERsida DB PASSWORD SimpleAlertReceiverArchiver.bat Cyber Solutions Inc., All rights reserved 1

4 1.2. Sida IODEF Generator daemon ASPATHS perl./as_paths_dnew.pl tmp/* config/db.properties Sida Receiver/Archiver config/sidaiodefgen.conf DOMAINIODEF SOURCE_NAME QUEUE_DIRqueue/ IODEF XML ERROR_DIRinvalid/ IODEF XML LIMITDB Snort Cyber Solutions Inc., All rights reserved 2

5 IODEF XML config/packetiodefaggr.conf DOMAINIODEF SOURCE_NAME QUEUE_DIRqueue/ IODEF XML ERROR_DIRinvalid/ IODEF XML DUMP_DATA_DIRdumpdata/ TIMEOUT SENSOR_ID ID config/contact.xml <ContactList><Contact><Contact> Contact contactrole contacttype <Contact> DTD ================================================================== == === Contact class === === - Name === - RegistryHandle === - PostalAddress === - === - Telephone === - Fax === - Timezone === - Contact (recursive) ================================================================== == --> Cyber Solutions Inc., All rights reserved 3

6 <!ELEMENT Contact (Name?, Description*, RegistryHandle*, PostalAddress?, *, Telephone*, Fax?, Timezone, Contact*)> <!ATTLIST Contact contactrole (creator admin tech irt cc) #REQUIRED contacttype (person organization) #REQUIRED restriction %attvals.restriction; #IMPLIED > ---- SidaIODEFGenerator.bat PacketIODEFGenerator.bat 1.3. Manual authoring config/iodeftrans.conf SMTP_SERVER SENDER_ADDERSS E RECIPIENT_ADDRESS E COMPLETED_DIRcompleted/ IODEF XML iodef_receiver ManualAuthoring.bat 1.4. IODEF Sender config/iodeftrans.conf SMTP_SERVER SENDER_ADDERSS E RECIPIENT_ADDRESS E COMPLETED_DIRcompleted/ IODEF XML Cyber Solutions Inc., All rights reserved 4

7 iodef_receiver IODEFSender.bat 1.5. IODEF Receiver / Archiver xindice XINDICE_HOME/ # XINDICE_HOME/startup # XINDICE_HOME/bin/xindiceadmin shutdown -c /db xindice xindice XML Document Document ID Collection iodef Collection Cyber Solutions Inc., All rights reserved 5

8 xindice (Native XML Database) db Collection Document iodef IncidentID incident1 IncidentID incident2 IncidentID incident3... db Collection db /db/iodef Collection # XINDICE_HOME/bin/xindiceadmin ac -c /db -n iodef Created : /db/iodef config/db.properties IODEF Receiver/Archiver XML DB Mailet DB HOSTIPxindice DBPORT4080DB DATABASEdb Collection COLLECTIONiodefIODEF Collection Cyber Solutions Inc., All rights reserved 6

9 James (Java Apache Mail Enterprise Server) IODEF James Mailet IODEF XML James James (1) apps/james/sar-inf/config.xml <config> <James> <servernames> <servername> DNS <dnsserver> <servers> <server> Windows XP dnsserver audodiscovery false <remotemanager> <handler> <administrator_accounts> <account> (2) James James /usr/local/iodef_center/ Windows run.bat SMTP POP Unix # /usr/local/iodef_center/bin/run.sh Using PHOENIX_HOME: /usr/local/iodef_center Using PHOENIX_TMPDIR: /usr/local/iodef_center/temp Using JAVA_HOME: /usr/local/java Running Phoenix: Phoenix James Cyber Solutions Inc., All rights reserved 7

10 Remote Manager Service started plain:4555 POP3 Service started plain:110 SMTP Service started plain:25 NNTP Service Disabled Fetch POP Disabled FetchMail Disabled (3) iodef 4555 telnet ( Remote Manager Service ) (1) root # telnet <HOST ADDRESS> 4555 Trying 1<HOST ADDRESS>... Connected to <HOST ADDRESS>. Escape character is '^]'. JAMES Remote Administration Tool Please enter your login and password Login id: Password: Welcome root. HELP for a list of commands adduser iodef iodef listusers adduser iodef iodef User iodef added Cyber Solutions Inc., All rights reserved 8

11 listusers Existing accounts 1 user: iodef James (2) IODEF XML James iodef XML XML DB shutdown 1.6. IODEF Analyzer Analyzerconfig/db.properties IODEF Analyzer XML DB DB HOSTIPxindice DBPORT4080DB DATABASEdb Collection COLLECTIONiodefIODEF Collection Analyzer.bat Cyber Solutions Inc., All rights reserved 9

1.6.1. Analysis Conditions Incident AnalysisAnalysis

13 Analysis Type Analysis Dos attack all around the worldwidely operated attacks Result View Degree of Observation Table ViewMap ViewGraph View Analyze Table View Cyber Solutions Inc., All rights reserved 11

Period Observation Point Observation Point

Incident TypeALLAlertPacketReport AnalyzeDisplay All DB Publish 2. 2.1. IODEF RidServer $ bin catalina.

16 Incident TypeALLAlertPacketReport AnalyzeDisplay All DB Publish IODEF RidServer $ bin catalina.bat start Tomcat(HTTP ) ) iodef_ridserver $ bin catalina.bat stop Cyber Solutions Inc., All rights reserved 14

17 2.2. IODEF Wide AreaTracker config/ridgen.conf DOMAINIODEF SOURCE_NAME NAME SRC_ADDRESS IP RID_QUERY_URL/iodef_ridserver/services/RIDQueryRID URL MAP_FILEconfig/map/map.dispmap DST_ADDRESS-0RID config/alertrecever.conf SNMPPORT162 - SNMP Trap/Notification Snort DATA_DIRdata/DATABASE Snort daemon ASPATHS perl./as_paths_dnew.pl tmp/* WideAreaTracker..bat Cyber Solutions Inc., All rights reserved 15

untitled

untitled 2004 1094 1.... 1 1.1....1 1.2....3 1.3....3 2. POSTGRESQL... 5 2.1. POSTGRESQL DB UNIX...5 2.2. POSTGRESQL DB WINDOWS...8 3. XML... 12 3.1. XINDICE (NATIVE XML DATABASE)... 12 3.2. XINDICE... 12 3.3.