网络安全设备联动系统日志预处理的研究与设计

发布时间：2018-04-22 09:39

本文选题：联动系统 + 预处理　；参考：《华北电力大学》2014年硕士论文

【摘要】：随着计算机网络规模的迅速壮大，多种多样的入侵手段使当前网络面临的安全问题日益突出。目前应用的各种网络安全设备，只对网络形成了单方面的防护，不能满足当前用户日益增长的安全需求，因此，从整体和联动的角度出发，构建以安全设备为基础，有效管理各设备的网络安全设备联动系统已经成为网络安全领域的研究热点。本文针对网络安全设备联动系统所需的底层数据进行了采集、清理、聚类分析和预测。研究了日志预处理的相关技术，设计了的网络安全设备的日志预处理模型。主要解决了以下几个问题：第一，对网络安全设备日志分布散乱、不易管理的问题，设计了日志采集平台对各安全设备的日志进行统一采集和管理，，并完成了平台搭建和最底层日志数据的采集工作。第二，本论文采用粒度级清理算法，对日志中的重复、不完整和错误数据等进行了清理工作。第三，运用回声状态网络算法对网络安全日志数据进行聚类分析，并利用KDD数据集进行训练和预测，通过预测结果与真实值的比较，验证了回声状态网络算法能够较为准确的根据日志数据的攻击类型进行分类。第四，本文将XML定为日志数据的统一描述语言，并通过Java+JDOM编程将各安全设备日志转换为XML文件，实现了联动系统中日志数据的标准化。本文将研究的模型应用到网络安全设备联动系统中，验证了日志预处理模型的可行性和有效性，所设计的网络安全设备联动系统主要包括日志数据的查询、清理和备份等功能，直观的展现了日志预处理的流程和主要功能，方便了管理员对日志数据的统一管理。
[Abstract]:With the rapid expansion of the computer network, the security problems facing the network are becoming increasingly prominent due to various intrusion methods. At present, all kinds of network security devices used only form unilateral protection to the network, and can not meet the increasing security needs of current users. Therefore, from the perspective of the whole and the linkage, we construct the security equipment as the foundation. Effective management of the network security equipment linkage system has become a research hotspot in the field of network security. In this paper, we collect, clean up, cluster analysis and predict the underlying data needed by the network security equipment linkage system. The related technology of log preprocessing is studied, and the log preprocessing model of network security equipment is designed. The main solutions are as follows: first, the network security equipment log distribution scattered, difficult to manage the problem, designed a log acquisition platform for the security equipment log collection and management, And completed the platform construction and the lowest level log data collection work. Secondly, this paper uses the granularity level cleaning algorithm to clean up the duplicate, incomplete and error data in the log. Thirdly, the echo state network algorithm is used to cluster the network security log data, and the KDD data set is used to train and predict the network security log data. The prediction results are compared with the real values. It is verified that the echo state network algorithm can be classified accurately according to the attack types of log data. Fourthly, this paper defines XML as the unified description language of log data, and converts the log of each security device into XML file through Java JDOM programming, and realizes the standardization of log data in the linkage system. This paper applies the model to the network security equipment linkage system, and verifies the feasibility and effectiveness of the log preprocessing model. The designed network security equipment linkage system mainly includes log data query, cleaning and backup functions. The process and main functions of log preprocessing are displayed intuitively, and the unified management of log data is facilitated.
【学位授予单位】：华北电力大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】