网络异常流量三维可视化研究

发布时间：2018-03-23 09:51

本文选题：入侵检测　切入点：网络安全可视化　出处：《天津理工大学》2014年硕士论文

【摘要】：随着技术的发展，计算机入网的门槛越来越低，网络用户的素质也是良莠不齐，导致了愈加猖獗的网络异常行为的出现，一些网络黑客实施的非法行为已经严重影响了正常的经济秩序和社会稳定。但是基于文本的传统网络入侵检测系统存在着认知负担过重、误报率和漏报率过高、人机交互力差、对网络全局认识的缺失、不能对网络异常事件进行提前防御等问题，无法满足人们对加强网络安全性能的迫切需要。网络可视化技术是网络安全与信息可视化的融合后产生的新技术。使用该技术可以将网络通信状况以图形的方式展示给用户，并允许用户进行交互式操作，从而实现对网络异常行为的分析和防御。该方式充分融合了人脑与计算机处理图像能力的优势，将海量高维网络数据以图形图像的方式展现出来，用户通过直观的图像可以快速掌握原本复杂的文本数据，从而轻松排查出当前网络存在的潜在安全威胁。在综合研究国内外网络可视化研究成果的基础上，本文设计了一个多视图的网络异常流量三维可视化系统，将已有的网络流量可视化与入侵检测日志可视化思想结合起来，旨在为解决网络安全难题提供新的方法。对于可视化系统的设计，本文根据异常流量特征针对性的设计可视化模型，并加入了强大的人机交互功能，使用户成为网络入侵检测系统循环反馈的一部分。三维可视化系统的目的是展现出比二维视图更加直观的动态图像，以多视图、多角度、多尺度的方式与用户进行交互。本文详细介绍了三维可视化系统的设计开发流程，数据可视化过程采用Java3D技术实现，，最后通过DARPA数据集和校园网流量进行验证。实验结果表明该系统能够根据SNORT检测日志生成有效的3D网络异常流量视图，而立方体散点图对于网络扫描、DDoS攻击等未被SNORT检测到的网络异常行为有较强的检测能力，在一定程度上缓解了SNORT入侵检测系统高误报率和漏报率的问题。
[Abstract]:With the development of technology, the threshold of computer access to the network is getting lower and lower, the quality of network users is also mixed, resulting in the emergence of increasingly rampant network abnormal behavior. Some illegal acts carried out by network hackers have seriously affected the normal economic order and social stability. However, the traditional text-based network intrusion detection system has a heavy cognitive burden, high false alarm rate and false alarm rate, and poor human-computer interaction. The lack of global understanding of the network, can not prevent the network anomalies in advance, can not meet the urgent need to enhance the network security performance. The technology of network visualization is a new technology after the fusion of network security and information visualization. Using this technology, the network communication status can be graphically displayed to users and users are allowed to operate interactively. In order to realize the analysis and defense of the abnormal behavior of the network, this method fully integrates the advantages of human brain and computer in image processing, and displays massive high-dimensional network data in the form of graphics and images. Users can quickly grasp the original complex text data through intuitive images, so that they can easily find out the potential security threats existing in the current network. Based on the research results of network visualization at home and abroad, a multi-view 3D visualization system for network abnormal traffic is designed in this paper, which combines the existing visualization of network traffic with the visualization of intrusion detection log. The purpose of this paper is to provide a new method for solving the problem of network security. For the design of visual system, the visualization model is designed according to the characteristics of abnormal traffic, and a powerful man-machine interaction function is added. The purpose of the 3D visualization system is to display a more intuitive dynamic image than the two-dimensional view, with multi-view, multi-angle, This paper introduces the design and development process of 3D visualization system in detail. The process of data visualization is realized by Java3D technology. Finally, it is verified by DARPA data set and campus network traffic. The experimental results show that the system can generate an effective 3D network abnormal traffic view according to the SNORT detection log. The cube scatter plot has a strong ability to detect the abnormal behavior of the network which has not been detected by SNORT such as network scanning DDoS attack, which to some extent alleviates the problems of high false alarm rate and false alarm rate in SNORT intrusion detection system.
【学位授予单位】：天津理工大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】