高抽象度网络模拟方法研究及其应用

发布时间：2019-01-14 17:18

【摘要】：网络模拟是研究网络活动和网络行为的重要手段之一,具有极高的学术研究与应用价值。随着计算机技术的不断发展,网络规模的不断扩大,对网络模拟方法的研究及其相关应用提出了更高的要求和目标。一方面,如何在复杂网络的模拟中,既降低网络拓扑的复杂度,即降低计算开销,减少模拟时间,又可以充分保证模拟的真实性,是网络模拟方法的研究需要解决的重点问题。另一方面,如何基于高抽象度网络模拟方法,对安全应用进行研究,例如入侵检测系统,是本文针对网络模拟应用领域解决的另一个重要问题。为此,本文以网络模拟方法的理论性研究作为切入点,对高抽象度网络模拟方法进行了深入的研究、分析和实验验证,意在调和网络模拟中“复杂性”和“真实性”这对矛盾。将理论研究上升到应用层面,基于基于高抽象度网络模拟方法,对网络安全应用进行研究,深入研究、优化、改进入侵检测系统中的检测模型,并进行攻击检测模拟实验验证。具体来说,本文主要研究内容包括以下三个方面:1)提出了一种新的高抽象网络模拟方法,即面向拓扑聚焦的网络流量模拟方法。该方法的主要思想是将网络拓扑划分为聚焦区域FTA(Focusing Topology Area)与非聚焦区域NFTA(Non-Focusing Topology Area),根据网络流量中数据包所在区域的不同,将数据包分为三种类型,对不同类型的数据包采取不同的模拟策略和算法。通过复杂网络的模拟实验表明,该方法能够降低网络复杂度,减小计算开销,同时保证了聚焦区域的模拟真实性,尤其是网络流量中数据包的真实性。2)提出了一个基于高抽象网络模拟的安全应用研究框架,基于网络模拟实验平台,对安全应用——入侵检测系统中的检测模型进行研究。在已有的基于经典DS(Dempster-Shafer)证据理论的入侵检测模型的基础之上,引入权值的概念,提出优化的DS证据理论,即ODS证据理论(Optimized DS evidence theory),并结合具有回归能力的基本概率赋值函数RBPA(Regression Basic Probability Assignment function),提出一个新的网络入侵检测模型,即ODS+RBPA模型。3)利用网络模拟技术和方法,模拟出一个具有多种入侵攻击的大规模复杂网络环境,在这个模拟的网络环境中验证ODS+RBPA入侵检测模型的性能及其有效性。通过与其他检测模型的多组模拟实验结果的比较、分析和讨论,验证新的检测模型不仅具有高检测率、低误警率和强稳定性,而且对未知攻击仍然具备很强的检测能力。
[Abstract]:Network simulation is one of the most important methods to study network activities and behaviors, and has high academic research and application value. With the development of computer technology and the expansion of network scale, the research of network simulation method and its related applications have put forward higher requirements and goals. On the one hand, how to reduce the complexity of network topology in the simulation of complex networks, that is, to reduce the computational overhead, reduce the simulation time, and fully guarantee the authenticity of simulation, is the key problem to be solved in the research of network simulation methods. On the other hand, how to study security applications, such as intrusion detection system, based on high abstraction network simulation method, is another important problem in this paper. Therefore, taking the theoretical research of network simulation as the starting point, this paper makes a deep research on the method of high abstraction network simulation, analyses and verifies it through experiments, aiming at reconciling the contradiction between "complexity" and "authenticity" in network simulation. The theoretical research is raised to the application level. Based on the high abstraction network simulation method, the application of network security is studied, deeply studied, optimized, the detection model in intrusion detection system is improved, and the attack detection simulation experiment is carried out. Specifically, the main contents of this paper include the following three aspects: 1) A new high abstract network simulation method is proposed, that is, topologically focused network traffic simulation method. The main idea of this method is to divide the network topology into focus area FTA (Focusing Topology Area) and unfocused area NFTA (Non-Focusing Topology Area), divides the data packet into three types according to the difference of the area in which the data packet is in the network traffic). Different simulation strategies and algorithms are adopted for different types of packets. The simulation results of complex networks show that the proposed method can reduce the complexity of the network, reduce the computational overhead and ensure the simulation authenticity of the focus region. Especially, the authenticity of data packets in network traffic. 2) A security application research framework based on high abstract network simulation is proposed. Based on network simulation experiment platform, the detection model in intrusion detection system (IDS) is studied. On the basis of the existing intrusion detection model based on classical DS (Dempster-Shafer) evidence theory, the concept of weight value is introduced, and an optimized DS evidence theory, ODS evidence theory (Optimized DS evidence theory), is proposed. Combined with the basic probability assignment function (RBPA (Regression Basic Probability Assignment function),) with regression ability, a new network intrusion detection model, ODS RBPA model, is proposed. 3) the network simulation technology and method are used. A large-scale and complex network environment with multiple intrusion attacks is simulated. The performance and effectiveness of the ODS RBPA intrusion detection model are verified in this simulated network environment. By comparing with the results of multi-group simulation experiments of other detection models, it is verified that the new detection model not only has high detection rate, low false alarm rate and strong stability, but also has a strong ability to detect unknown attacks.
【学位授予单位】：江南大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08

【相似文献】