安全审计技术研究及在著作权登记系统中的应用

发布时间：2018-05-29 20:47

本文选题：Web + 日志　；参考：《北方工业大学》2017年硕士论文

【摘要】：互联网技术的快速发展使Web应用成为使用最广泛的信息系统,但也造成了很多Web安全隐患,黑客可以使用技术手段非法得到应用服务器的管理员权限,从而篡改、窃取企业和个人重要数据。这些问题使越来越多的人开始关注企业应用安全问题。大多数威胁具有固定特征,但有些威胁会因系统的架构和编程语言不同而没有固定特征。传统的防御手段如应用防火墙等都是根据已知漏洞进行安全检查,但是针对动态网站的入侵一般是没有特定规则的,所以需要实现一种能分析用户规则的安全审计系统来加强对Web应用的防护。大型Web站点每天都会生成大量日志记录,我们需要在这些海量日志中挖掘出对企业安全有价值的内容。现在单节点的数据挖掘系统已无法满足挖掘海量Web日志的需求。利用分布式框架分析和存储日志能解决此问题。其中Apache Hadoop Yarn是一种新型资源管理系统,它在集群利用率和资源管理等方面有着更高的效率,所以在日志分析、数据挖掘和实时计算等方面有着较好的应用。而且它的文件系统具有高吞吐量和高容错性等特点,很适合存储海量的日志文件。它提供的针对大数据处理的分布式编程模型Map/Reduce也可以方便的编写处理海量日志文件的程序代码。本文针对企业在日志处理和分析方面出现的问题进行研究,使用基于Hadoop Yarn的Map/Reduce、Spark Streaming和改进的PFP-Growth算法实现了一个安全审计系统。主要包括日志的采集和存储、建立用户行为规则库和审计界面展示,此系统较之前的审计方案都有很大的改进,提高了海量日志挖掘过程的时空效率和工作效率。
[Abstract]:With the rapid development of Internet technology, Web application has become the most widely used information system, but it has also caused a lot of potential Web security problems. Hackers can use technical means to illegally obtain the administrative authority of the application server, thereby tampering with it. Stealing important data from businesses and individuals. These problems make more and more people begin to pay attention to the problem of enterprise application security. Most threats have fixed characteristics, but some do not have fixed features due to system architecture and programming languages. Traditional defense methods such as application firewalls are based on known vulnerabilities to carry out security checks, but there are generally no specific rules for the intrusion of dynamic websites. Therefore, it is necessary to implement a security audit system that can analyze user rules to strengthen the protection of Web applications. Large Web sites generate a lot of logging every day, and we need to dig out valuable content for enterprise security in these massive logs. Now the single node data mining system can not meet the demand of mining massive Web logs. Using distributed framework to analyze and store logs can solve this problem. Apache Hadoop Yarn is a new resource management system, which has higher efficiency in cluster utilization and resource management, so it has a good application in log analysis, data mining and real-time computing. Moreover, its file system has the characteristics of high throughput and high fault tolerance, so it is suitable for storing massive log files. It provides a distributed programming model for big data processing, Map/Reduce can also easily write the processing of massive log files program code. In this paper, the problems of log processing and analysis in enterprises are studied, and a security audit system is implemented by using Map-ReduceSpark Streaming based on Hadoop Yarn and the improved PFP-Growth algorithm. It mainly includes the collection and storage of logs, the establishment of user behavior rule base and the display of audit interface. The system has a great improvement over the previous audit scheme, and improves the space-time efficiency and work efficiency of the massive log mining process.
【学位授予单位】：北方工业大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.13;TP393.08

【参考文献】