网络安全流数据可视化技术研究

发布时间：2018-04-28 00:45

本文选题：网络安全可视化 + 流数据　；参考：《天津理工大学》2016年硕士论文

【摘要】：网络安全可视化已成为网络安全研究工作中的一个热门研究领域。面对当前海量高维的网络安全数据、愈发精细的入侵攻击和网络结构的不断复杂化等问题,网络安全可视化以其具有对数据降维简化、易于发现和挖掘异常与攻击等数据分析优势,其已深受网络安全分析及管理人员的青睐,同时,网络安全可视化研究也越发受到人们重视。网络安全流数据在网络异常检测、网络攻击的发现等工作都有较好的应用。本文对通过网络安全可视化对网络安全流数据分析的方法和应用做了深入的研究。通过对信息可视化、网络安全可视化、网络流数据这三方面的技术和理论的学习与研究,并在借鉴了传统网络流系统设计思想和网络安全可视化基本流程的基础上,本文提出了一个对网络安全流数据进行可视分析的系统模型。此模型包括了数据采集、数据接收、数据的处理、数据的可视化及人机交互。同时,利用这个系统模型本文设计并实现了两个基于网络流数据的可视分析系统。本文中实现了一个利用NetFlow数据进行网络扫描检测及分析的可视分析系统。在此系统中实现了一个对大规模数据集进行可视表达的新可视化方法。同时,此系统还结合了平行坐标视图和地理热力图两种可视化方法,完成了对网络扫描的检测和分析工作。通过在实际应用中对校园网中的实时NetFlow数据的分析,证明了本系统在网络扫描的检测和分析工作中的有效性和实用性。另外,本文还实现了一款通过分析TcpFlow数据来区分网络中的服务器与客户端、划分网络拓扑结构、对服务器进行分类、发现网络中存在的通信模式的可视分析系统,在此系统中设计了多种可视化方法用于分析以上问题。此系统可以帮助网络管理人员及网络安全分析人员快速了解整个网络结构和网络运行特征,便于对网络的管理以及对网络安全事态的感知。
[Abstract]:Network security visualization has become a hot research field in network security research. In the face of the current mass of high-dimensional network security data, increasingly sophisticated intrusion attacks and network structure complexity, network security visualization can simplify the data dimension reduction. It is easy to find and mine anomalies and attacks and other data analysis advantages, it has been favored by network security analysis and management personnel, at the same time, the research of network security visualization has been paid more and more attention. Network security stream data has good applications in network anomaly detection and network attack detection. In this paper, the methods and applications of network security flow data analysis through network security visualization are studied. Based on the study and research of the technology and theory of information visualization, network security visualization and network flow data, and on the basis of drawing lessons from the traditional network flow system design idea and the basic flow chart of network security visualization, This paper presents a system model for visual analysis of network security stream data. The model includes data acquisition, data receiving, data processing, data visualization and human-computer interaction. At the same time, two visual analysis systems based on network flow data are designed and implemented by using this system model. In this paper, a visual analysis system using NetFlow data for network scan detection and analysis is implemented. A new visualization method for visual representation of large scale data sets is implemented in this system. At the same time, the system combines two visualization methods, parallel coordinate view and geo-thermal map, to complete the detection and analysis of network scanning. Through the analysis of the real-time NetFlow data in the campus network, the validity and practicability of the system in the detection and analysis of the network scanning are proved. In addition, this paper also realizes a visual analysis system which can distinguish the server from the client by analyzing the TcpFlow data, divide the network topology, classify the server, and find the communication mode in the network. In this system, many visualization methods are designed to analyze the above problems. This system can help network managers and network security analysts to quickly understand the whole network structure and network operation characteristics, facilitate the management of the network and the perception of network security situation.
【学位授予单位】：天津理工大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】