网间IP流量行为分析与关系发现

发布时间：2018-03-22 16:32

本文选题：网络安全态势感知　切入点：主机行为轮廓建立　出处：《东南大学》2016年博士论文　论文类型：学位论文

【摘要】：互联网是一个由数以百万计的本地网络组成的全球性网络,承载着广泛的信息资源与和服务。在网络空间中运作的系统和网络存在安全漏洞,给使用它们的个人、组织与国家带来安全风险。互联网威胁是各国面临的最严重的经济和安全挑战之一。安全研究人员提出了各种的策略,以减少网络威胁的影响,提高抵御网络攻击的能力。这其中的一个关键是对攻击准确而及时的发现,因此防御方的角色中包括复杂的认知任务。种类繁多的安全、监控和分析工具被用于检测网络渗透和分析网络性能,例如防病毒软件,防火墙,日志审计工具,基于主机和基于网络的入侵检测系统IDS,低交互和高交互的蜜罐系统,通用和专用的蜜罐系统,网络流量分析工具等等。这些不同来源的安全工具产生的海量数据使得网络安全工程师越来越更难以处理。同时人们也意识到,依赖单一工具是不足以保护网络使其免遭各种威胁。基于持续监控和所得的安全警报事件,网络安全态势感知NSSA提供了高层次的安全视图,可以有能力依据这些安全事件之间的多维度关联来确定计算机网络的总体安全状态。本文的贡献在于为建立IP信息数据库提供了关于网络流量行为的背景信息,以支持网络安全态势感知。这种IP信息有助于预测网络安全的变化趋势。论文研究了IP主机行为轮廓建立(Profiling)和分簇问题,目的在于标识出主机流量行为中主要的和持续性的部分,借以构成主机的行为轮廓,分析具有相似行为的主机群组。这将丰富IP特性数据库的内容,支持网络安全态势感知在觉察阶段和理解阶段的研究工作。IP行为轮廓的建立基于所观察到的最显著活跃的IP地址的流量模式。论文提出了一种算法来提取用于分析的最显著IP节点,避免了对全部流量中数以百万计的IP节点进行全部分析(数据压缩)。论文讨论了主机通信行为模式的特征,这些特征可用于描述主机的行为特征以建立主机行为轮廓。论文从抽取或计算了15个有关IP地址流量行为的流量模式,作为特征用于之后的数据聚类处理。论文以选定的IP地址进行了相对较长时间范围内的流量数据分析,以便提取其更为稳定的主机流量行为。以往的研究都集中在相对较短时间粒度的主机行为观察上,论文选择以一个小时作为一个时间粒度,这意味着限定时间内一个粒度内需要处理更多的流量数据。论文研究了可表示管理域内网络主机与外部IP网络主机之间的社会关系的IP地址之间关系问题。论文方法的起点是将整个IP地址空间分割成为内部(被管域内)和外部(网络外)两部分。聚类的策略是将有共同外部IP地址作为通信对端的内部IP地址定义一个群组,两个内部IP地址的相似性测度是两者拥有的相同的对端外部IP地址数量。论文提出用了一种使用近似算法的新方法,可在大规模的被管理域中发现存在的社区结构,该方法基于二部图方法,单模式投影和相似图的图形分割方法。将从实际的管理域边界路由器采集NetFlow数据集中包含的IP地址按内部地址空间和外部地址空间构造二部图,然后使用单模式投影方法构建内部IP地址社会关系的相似图。论文设计了一个新的社区检测算法来检测具有类似行为的社区。论文通过应用深度流检测(DFI)方法和深度数据包检测(DPI)方法对理论计算结果进行了实验验证,证明用同一群集的主机的主要流量行为通常相似。论文展示了探索IP主机社会行为相似性的用途,包括理解应用程序的使用,理解用户的行为,检测恶意用户和禁止的应用的用户。
[Abstract]:The Internet is a by millions of local network composed of global network, carries a wide range of information resources and service system and network operation. In the space of Internet security vulnerabilities, use them to individuals, organizations and countries pose a security risk. The Internet threat is one of the most serious economic and security challenges of the world facing. Security researchers have proposed various strategies to reduce the impact of cyber threats, improve the ability to resist network attacks. One of the key is to attack the accurate and timely discovery, thus including complex cognitive tasks defending role. Many kinds of security monitoring and analysis tools are used detection of network penetration and network performance analysis, such as antivirus software, firewall, log audit tools, host and network intrusion detection system based on IDS, low and high. The honeypot system interaction honeypot system, general and special, network traffic analysis tools and so on. These produce vast amounts of data from different sources of security tools makes network security engineers more and more difficult to deal with. At the same time people realized that, depending on the single tool is not enough to protect the network from various threats. Security alert and continuous monitoring based on the network security situational awareness, NSSA provides a safe view of high level, can have the ability on the basis of multi dimension association between these events to determine the overall security of computer network. The contribution of this paper is to provide background information about the network traffic behavior for the establishment of a IP information database, to support the network security situation awareness. The change trend of this IP information can help to predict the network security. This paper studies the IP host behavior profile establishment (Profiling) and cluster The problem, purpose is to identify the host traffic behavior in major and persistent part, so as to constitute a behavior profile of the host, the host group with similar behavior analysis. This will enrich the IP characteristics of the contents of the database, support network security situation awareness based on the research work of.IP awareness and understanding of phase behavior profile of the observed phase based on the most significant active IP address traffic patterns. This paper presents an algorithm to extract the most significant IP for node analysis, avoid all nodes on the IP to analyze tens of millions in all traffic (data compression). This paper discusses the characteristics of the host communication behavior, these features can be used to describe the behavior of the characteristics of the host to establish the host behavior profile. This paper calculated the 15 IP address flow behavior from the extraction or traffic patterns, as the features for the data clustering Processing. In order to selected IP addresses analyzed traffic data relatively long time range, in order to extract the more stable host traffic behavior. Previous studies have focused on the host behavior in a relatively short time to observe the size, we take an hour as a time granularity, which means limited a time granularity within the need to deal with more traffic data. The relationship between the network management domain host can be expressed with the external IP network host IP address. The social relationship is the starting point of the method of IP address space is divided into internal (managed domain) and external (Network) two. Clustering strategy is to have a common external IP address as the internal communication IP address to end the definition of a group, two internal IP address similarity measure is the same for both have end The number of IP addresses. This paper proposed a new method using approximate algorithm, can be found in the large-scale management of community structure exists in the domain, the method is based on the method of figure two, single pattern projection segmentation method and similarity map graphics. From the management of actual road boundary consists of a collection containing NetFlow the data set IP address according to the internal and external address space address space two map, and then construct similar graph of the internal IP address social relations using single mode projection method. This paper designed a new community detection algorithm to detect similar to the community. Through the application of deep flow inspection (DFI) method and deep packet inspection (DPI) methods are used to validate the theoretical calculation, proved that the main flow behavior of the same cluster host usually similar. This thesis demonstrated the exploration of IP host social behavior similarity The use of understanding the use of the application, understanding the behavior of the user, detecting the malicious users and users of the forbidden application.

【学位授予单位】：东南大学
【学位级别】：博士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】