基于OHCBF-Trap结构的超点检测算法研究

发布时间：2018-03-07 21:47

本文选题：网络测量　切入点：主机基数　出处：《大连海事大学》2017年硕士论文　论文类型：学位论文

【摘要】：超点是指在一个检测周期内链接大量不同源主机或目的主机的主机,超点检测对网络安全和网络管理具有重要意义。网络中存在着许多安全事件,如分布式拒绝服务攻击(DDoS)、蠕虫病毒和端口扫描等都具有类似的行为特征,这些事件都属于超点检测问题。由于标准Bloom Filter在使用简单的哈希函数进行哈希映射时,存在着计算开销大,且哈希不均匀的问题,本文设计出一种低计算开销的过滤器OHCBF。该过滤器只需要一个基础哈希函数和几个简单的操作就可以实现标准Bloom Filter的功能,显著地降低了进行哈希映射时的计算开销。针对目前一些超点检测算法存在着内存消耗较大或检测结果准确性不高的问题,本文提出基于OHCBF-Trap结构的超点检测算法。该算法对Snare算法做了进一步的改进,提出一种新的存储结构Trap,并将OHCBF与Trap结构相结合来进行超点检测。由于OHCBF只允许每个流中的第一个报文进入存储结构Trap,能够有效地减少系统的计算开销。同时,在存储结构Trap中用存储流的数量代替存储报文的数量,这样就可以省略用报文数估算流数的过程,减少了系统的计算开销。最后,对提出的超点检测算法进行理论分析。为了使实验数据更具有代表性,本文使用不同地区采集的真实网络Trace进行实验。实验结果表明,基于OHCBF-Trap结构的超点检测算法能够准确地检测出超点。通过与其它超点检测算法的实验结果相比较可知,本文提出的超点检测算法在内存消耗和检测的准确性方面具有一定优势。
[Abstract]:Super-point is a host that links a large number of different hosts or destination hosts in a detection cycle. Super-point detection is of great significance to network security and network management. There are many security events in the network. For example, distributed denial-of-service attacks such as DDoS, worm and port scanning all have similar behavior characteristics. These events are hyper-point detection problems. Because standard Bloom Filter uses simple hash functions for hash mapping, In this paper, we design a low computational overhead filter OHCBF, which requires only a basic hash function and a few simple operations to realize the function of standard Bloom Filter. The computation cost of hash mapping is significantly reduced. At present, some hyper-point detection algorithms have some problems such as large memory consumption or poor accuracy of detection results. In this paper, we propose a hyper-point detection algorithm based on OHCBF-Trap structure, which improves the Snare algorithm further. In this paper, we propose a new storage structure, Trap. and combine OHCBF with Trap structure to detect hyperpoints. Because OHCBF only allows the first packet in each stream to enter into the storage structure, it can effectively reduce the computing cost of the system. In memory structure Trap, the number of stored packets is replaced by the number of storage streams, so that the process of estimating the number of streams by the number of packets can be omitted, and the computational overhead of the system can be reduced. In order to make the experimental data more representative, we use the real network Trace collected from different regions to carry out experiments. The experimental results show that, The super-point detection algorithm based on OHCBF-Trap structure can accurately detect the super-point. Compared with the experimental results of other super-point detection algorithms, the proposed super-point detection algorithm has some advantages in memory consumption and accuracy.
【学位授予单位】：大连海事大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.0

【相似文献】