网络安全设备联动系统中事件关联模型的研究与应用

发布时间：2018-04-21 22:42

本文选题：联动系统 + 事件关联模型　；参考：《华北电力大学》2014年硕士论文

【摘要】：随着Internet的飞速发展，网络安全问题俨然成为困扰人们的一类重大问题，各类安全设备的单兵作战已经不能满足网络安全的需求，急需将它们有效地协助起来更好的应对愈来愈复杂的网络问题。如何将各种各样的安全设备联动起来，自动地预测网络中存在的危险，已经成为当前网络信息安全研究的重点问题之一。本文结合网络安全设备联动系统中各类安全设备产生的安全事件的特点，针对增量关联规则算法--FUP算法存在的不足，引入矩阵的思想，改进了FUP算法，并通过理论分析和仿真实验验证了改进后的算法在时间复杂度和空间复杂度方面的优越性。在此基础上，设计了一个层次化的事件关联模型。该模型首先收集代理产生的事件信息，用统一的事件形式将其格式化，然后通过过滤规则和聚合规则消除冗余重复的数据，并将处理过的安全事件保存到事件数据库；接着用改进的FUP算法挖掘安全事件，找出隐藏在数据背后的关联规则，通知管理员，及时采取防范措施，预防可能发生的危险事件；管理员通过管理界面可以查询特定安全事件以及当前的网络状况等。最后，将此模型应用到网络安全设备联动系统中，以防火墙和用户产生的日志作为数据源，根据数据在模型中的处理流程，实现了对异常行为和攻击的预测，验证了模型的有效性，，进一步完善和提高了系统的整体性能。
[Abstract]:With the rapid development of Internet, network security has become a major problem that puzzles people. The single combat of all kinds of security equipment can no longer meet the needs of network security. There is an urgent need to help them effectively deal with increasingly complex network problems. How to link up all kinds of security devices and automatically predict the danger in the network has become one of the key problems in the research of network information security. In this paper, considering the characteristics of the security events produced by various kinds of security devices in the network security device linkage system, aiming at the shortcomings of the incremental association rule algorithm, FUP algorithm, the idea of matrix is introduced, and the FUP algorithm is improved. The advantages of the improved algorithm in time complexity and space complexity are verified by theoretical analysis and simulation experiments. On this basis, a hierarchical event association model is designed. The model firstly collects the event information generated by the agent, formats it in the form of unified events, then eliminates redundant and duplicated data by filtering rules and aggregation rules, and saves the processed security events to the event database. Then the improved FUP algorithm is used to mine the security events, find out the association rules hidden behind the data, notify the administrator, and take preventive measures in time to prevent the dangerous events that may occur. Administrators can query specific security events and current network conditions through the management interface. Finally, the model is applied to the network security device linkage system. The firewall and user-generated log are used as the data source. According to the processing flow of the data in the model, the abnormal behavior and attack prediction are realized. The effectiveness of the model is verified and the overall performance of the system is further improved and improved.
【学位授予单位】：华北电力大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】