基于内容的网络行为分析

发布时间：2018-11-24 19:30

【摘要】：现代社会,人们的日常生活越来越离不开网络,因特网是我们学习、生活、工作的一部分,它甚至改变了人们的日常生活习惯和生活特性。然而,互联网的发展给人们带来极大便利的同时,它也为病毒、木马、网络攻击等影响网络安全的行为提供了途径,因此如何净化网络环境,保护用户的信息安全成为当务之急。以前网络安全的研究内容主要是研究怎样保证信息的机密性,而现在网络安全的研究已经发展到了系统服务的安全,比如我们常见的网络安全系统,包括应用防火墙、入侵检测系统、防病毒系统等。这些系统大多数都是应用传统的方法,只对数据包的包头进行分析,可是很多攻击行为都隐藏在数据包的内容之中,鉴于此,本文采用基于内容的网络行为分析方法来完善传统的分析方法。本文以网络数据包为主要研究对象,通过内容特征分析网络数据包所表现出的网络访问行为。主要研究内容包括四个方面,分别是网络数据包捕获技术的研究,基于内容的异常行为的研究,设计并构建网络行为特征库和网络行为高效匹配的研究。论文的最后进行了本系统设计方案的测试,实践结果表明,这种基于数据包内容的分析方法能够较为准确地判断数据包是否有异常行为,这对于探测网络漏洞、常见攻击及研究防范措施等都具有十分重要的意义。
[Abstract]:In modern society, people's daily life is more and more inseparable from the network. The Internet is a part of our study, life and work. It even changes people's daily life habits and characteristics. However, the development of the Internet brings great convenience to people, at the same time, it also provides a way for virus, Trojan horse, network attack and so on to affect the network security, so how to purify the network environment, It is urgent to protect the information security of users. In the past, the research on network security mainly focused on how to ensure the confidentiality of information, but now the research on network security has developed to the security of system services, such as our common network security systems, including application firewalls. Intrusion detection system, antivirus system, etc. Most of these systems are based on traditional methods, only analyzing the packet headers, but many attacks are hidden in the contents of the packets. This paper uses the content-based network behavior analysis method to perfect the traditional analysis method. In this paper, the main research object is network data packets, and the network access behavior of network data packets is analyzed by content characteristics. The main research contents include four aspects: the research of network packet capture technology, the research of content-based abnormal behavior, the design and construction of network behavior signature library and the research of efficient matching of network behavior. At the end of the paper, the test of the system design scheme is carried out. The practical results show that the method based on data packet content analysis can accurately judge whether the packet has abnormal behavior, which can detect the network vulnerability. Common attacks and research on preventive measures are of great significance.
【学位授予单位】：北方工业大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【参考文献】