网络入侵事件检测及攻击行为预测的方法研究

发布时间：2018-12-10 18:28

【摘要】：随着网络与信息技术的发展，互联网的广泛普及和应用，网络正逐步改变着人类的生活和工作方式，尤其是云计算、物联网、智慧城市、移动互联网和微博等新一代应用和技术在当代生活中得到广泛应用，在促进应用创新的同时，也将带来严重的信息安全隐患。攻防的不断发展，安全威胁的不断进化，新应用、新技术的广泛使用，对原有的安全保障理念和模式也将带来巨大的冲击，原有的安全检测手段已经不能完全解决面临的安全问题。针对这种情况，入侵检测作为一种主动防御技术，对网络进行检测，提供对内部攻击、外部攻击和误操作的实时监控，能够在入侵攻击对网络系统造成危害前，及时检测到入侵攻击的发生，并进行报警，在入侵攻击发生时，可以通过与防火墙联动等方式进行报警及动态防御，被入侵攻击后，可以提供详细的攻击信息，便于取证分析，从而大大提高了网络的安全性，给网络带来全面的防御。本文针对网络入侵事件提出了有效的检测算法，并针对网络中的攻击行为构建预测模型，对可能发生的攻击进行预测。 (1)提出一种基于HCRF (Hidden Conditional Random Field)的入侵事件检测方法。针对网络入侵数据维数较高的特点，首先对原始数据集进行人工约减，之后进行规范化处理，消除由属性度量差异对算法产生的影响，然后对不同类别的原始会话记录建立特征向量序列和对应的标签序列，构建入侵事件的HCRF模型，实现基于HCRF模型的入侵事件检测和攻击行为分类。实验结果表明该算法在处理有限样本和高维样本上表现出了特有的优势，，即准确率高，不需要复杂训练、计算量小，在保证了检测率和误报率的同时，降低了训练与测试时间，证明了数据特征降维的有效性和可行性。 (2)提出一种基于HMM (Hidden Markov Model)的攻击行为预测方法。通常成功的攻击都不会是简单的单步攻击，越是危险级别高的攻击活动，其攻击步骤越是复杂多样，每一阶段都会触发不同的报警信息，随着系统受威胁程度的加深，报警信息不断累积，观察者根据这些报警信息建立HMM预测模型，该预测模型分为两层：1）由报警信息风险值组成的观察层；2）由攻击行为造成的系统威胁程度组成的隐藏层。该算法实现了已知当前状态预测下一时刻系统的威胁等级，实验结果表明预测效果较佳。最后对本文研究内容进行了总结，展望了未来的研究方向。
[Abstract]:With the development of network and information technology, the wide spread and application of the Internet, the network is gradually changing the way of human life and work, especially cloud computing, Internet of things, intelligent city. Mobile Internet and Weibo and other new generation of applications and technologies are widely used in contemporary life, while promoting application innovation, will also bring serious information security risks. The continuous development of attack and defense, the constant evolution of security threats, the new applications and the extensive use of new technologies will also bring tremendous impact to the original concept and mode of safety and security. The original means of safety detection can not completely solve the security problems. In view of this situation, intrusion detection, as an active defense technology, detects the network, provides real-time monitoring of the internal attack, external attack and misoperation, and can do harm to the network system before the intrusion attack causes harm to the network system. The intrusion attack can be detected and alerted in time. When the intrusion attack occurs, the alarm and dynamic defense can be carried out by means of linkage with the firewall. After being attacked, the attack information can be provided in detail, which is convenient for forensic analysis. Thus greatly improves the network security, brings the overall defense to the network. In this paper, an effective detection algorithm for network intrusion events is proposed, and a prediction model is constructed for the attack behavior in the network to predict the possible attacks. (1) an intrusion detection method based on HCRF (Hidden Conditional Random Field) is proposed. In view of the high dimension of network intrusion data, the original data set is reduced manually, and then standardized processing is carried out to eliminate the influence of attribute measurement difference on the algorithm. Then, the feature vector sequence and the corresponding tag sequence are established for different kinds of original session records, and the HCRF model of intrusion events is constructed. Intrusion event detection and attack behavior classification based on HCRF model are realized. The experimental results show that the algorithm has its own advantages in dealing with finite and high-dimensional samples, that is, high accuracy, no need of complex training, small amount of calculation, and low detection rate and false alarm rate, while reducing the training and testing time. The validity and feasibility of dimensionality reduction of data features are proved. (2) an attack behavior prediction method based on HMM (Hidden Markov Model) is proposed. Usually a successful attack is not a simple one-step attack. The more dangerous an attack is, the more complex and diverse the attack steps are, and each stage triggers a different alarm message, as the system becomes more threatened. According to the alarm information, the observer establishes the HMM prediction model. The prediction model is divided into two layers: 1) the observation layer is composed of the alarm information risk value; 2) A hidden layer consisting of the degree of system threat caused by the attack. The algorithm realizes the threat level of the system at the next moment when the current state is known. The experimental results show that the prediction effect is better. Finally, the research content of this paper is summarized, and the future research direction is prospected.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】