基于网络流量的入侵检测与IP回溯方法研究

发布时间：2018-06-03 13:45

本文选题：网络攻击 + 自相似性　；参考：《北京邮电大学》2017年硕士论文

【摘要】：随着“互联网+”时代的到来,网络与我们生活的方方面面联系越来越密切,科技的进步与发展在为我们带来便捷的同时,也为我们的信息安全带来了更多的隐患。频发的网络攻击,如DDoS (分布式拒绝服务)攻击,影响了合法用户的正常网络使用,更可怕的是带来巨大的经济财产损失。在应对网络入侵时,检测和及时追踪是两个主要环节。然而现在的检测技术存在检测率和误判率难以平衡的问题,追踪技术存在资源耗费及鲁棒性差的问题。针对这些问题,本文提出了以下方案:1)在原有单变量自相似流量模型的基础上,提出了二元自相似流量模型。基于数据包和字节的时间序列统计,使用分枝定界过程,对模型参数进行优化,通过一系列对比实验,可验证该模型的异常检测能力优于单变量自相似流量模型。2)将前面提出的二元自相似流量模型与深度学习相结合,提出了一种混合入侵检测模型,即检测分为流量异常判定和异常流量分类两个步骤。由于深度学习具有强大的特征学习能力,所以经实验验证,该模型具有较高的识别精度和检测速度,检测正确率达93%。3)为在检测出入侵后能够及时做出有效回应,针对DDoS攻击,对基于蚁群算法的IP回溯方案进行了改进。提出的新方案无需网络服务提供商配合和过多资源消耗,能在有限的数据包量和有限时间内达到较好的回溯效果,例如当网络拓扑大小为800个节点时,该方案的性能表现高于ACS-IPTBK回溯方案37.5%左右。且能够应对IP伪造的情况。
[Abstract]:With the arrival of the "Internet" era, the network and all aspects of our lives are more and more closely linked. The progress and development of science and technology not only bring convenience to us, but also bring more hidden dangers to our information security. Frequent network attacks, such as DDoS (distributed denial of Service) attacks, affect the normal network use of legitimate users, and even more terrible, bring huge loss of economic property. In response to network intrusion, detection and timely tracking are two main links. However, the detection rate and misjudgment rate are difficult to balance in the current detection technology, and the problem of resource consumption and poor robustness exists in the tracking technology. To solve these problems, this paper proposes the following scheme: 1) based on the original single-variable self-similar flow model, a binary self-similar flow model is proposed. Based on the time series statistics of data packets and bytes, the model parameters are optimized by using branch-and-bound process, and a series of comparative experiments are carried out. It can be verified that the anomaly detection ability of this model is better than that of single variable self-similar traffic model. 2) A hybrid intrusion detection model is proposed by combining the binary self-similar traffic model and depth learning. The detection is divided into two steps: flow anomaly determination and abnormal flow classification. Because of the strong feature learning ability of depth learning, the model has high recognition accuracy and detection speed, and the detection accuracy is 93.3) in order to be able to make an effective response to the DDoS attack in time after detecting the intrusion, the model is verified by experiments. The IP backtracking scheme based on ant colony algorithm is improved. The proposed scheme does not require the cooperation of network service providers and excessive resource consumption, and can achieve a better backtracking effect in a limited number of packets and in a limited time. For example, when the network topology size is 800 nodes, The performance of this scheme is about 37.5% higher than that of ACS-IPTBK backtracking scheme. And can deal with IP forgery.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】