校园网安全数据的采集与集中分析处理系统的设计与实现

发布时间：2018-01-09 07:36

本文关键词：校园网安全数据的采集与集中分析处理系统的设计与实现　出处：《北京交通大学》2017年硕士论文　论文类型：学位论文

【摘要】：飞速发展的计算机技术是把双刃剑,在给我们带来了巨大便利的同时,网络安全问题也变得越来越严重,为了保证网络的安全,校园网中部署了多种网络安全防护设备和系统,例如入侵防御系统(IPS)、WEB应用防火墙(WAF)等等,这些设备在工作过程中会产生大量的安全数据(主要是各种日志数据)。这些安全数据详细记录了校园网内的各个网站遭受攻击情况。通过对安全数据进行收集、分析,可以筛选出误报数据和真正的入侵数据。但是,这些安全数据分散在各个系统上,需要登录到各个系统上才能掌握相应的安全防护情况,非常繁琐,并且根据分散的数据很难对校园网的安全情况得到全面、客观的了解,所以,急需一个数据采集、分析、处理系统将上述数据整合起来并做统一的分析、研究,动态的展现分析结果,并将结果反馈给安全管理员,使安全管理员可以及时调整入侵检测的严格程度,本课题基于以上需求研发,主要工作包括以下几个方面:(1)数据的收集与存储:将入侵防御系统(IPS),WEB应用防火墙(WAF)产生的安全数据通过日志收集服务器收集并存储到数据库中,经过简单的数据清洗和完善后得到规整数据。(2)数据分析:对上一步中的规整数据进行分析,根据受攻击系统的备案信息和入侵行为的特征从安全数据中筛选出误报数据和入侵数据。(3)动态可视化:采用柱状图、饼图、折线图等图表将分析结果动态直观地展现出来,以便于我们对校园网的整体安全情况有一个直观的了解。(4)将入侵数据和误报数据生成电子邮件发送给系统负责人和安全管理员,使他们能够及时采取有效的应对措施。本文详细阐述了校园网安全数据的采集与集中分析处理系统的设计与实现,同时将介绍采用的技术方案,通过本系统,一方面减少了管理员的操作和工作量,提高了工作效率,另一方面可以使我们更加全面、客观掌握校园网安全现状,更进一步,可以提高整个学校的网络防御水平,保障校园网的安全。
[Abstract]:The rapid development of computer technology is a double-edged sword, in order to ensure the security of the network, the network security problem has become more and more serious. A variety of network security equipment and systems are deployed in the campus network, such as the intrusion Prevention system (IDS) and the Web Application Firewall (WAF) and so on. These devices generate a large amount of security data (mainly log data) during the course of their work. These security data provide a detailed record of attacks on various sites within the campus network. Security data are collected through the collection of security data. The analysis can filter out false positive data and real intrusion data. However, these security data are scattered on each system and need to log on to each system to grasp the corresponding security protection, which is very cumbersome. And according to the scattered data, it is difficult to get a comprehensive and objective understanding of the security situation of campus network. Therefore, a data acquisition, analysis and processing system is urgently needed to integrate the above data and do a unified analysis, research. Dynamic display of the analysis results and feedback to the security administrator, so that the security administrator can adjust the severity of intrusion detection in a timely manner, this subject is based on the above requirements research and development. The main work includes the following aspects: 1) data collection and storage: the intrusion Prevention system (IPS). The security data generated by the WEB application firewall is collected and stored into the database through the log collection server. After simple data cleaning and improvement, get regular data. 2) data analysis: the analysis of the previous step of the regular data. According to the record information of the attacked system and the characteristics of the intrusion behavior, the false alarm data and the intrusion data are screened out from the security data. The analysis results are displayed dynamically and intuitively by charts such as broken line diagrams. So that we can have a visual understanding of the overall security of the campus network. 4) the intrusion data and false positive data generation email to the system leader and security administrator. This paper describes the design and implementation of the campus network security data collection and centralized analysis and processing system. At the same time, it will introduce the technical scheme, through this system. On the one hand, it can reduce the operation and workload of the administrator, improve the work efficiency, on the other hand, can make us more comprehensive, objective grasp the campus network security status, further. It can improve the network defense level of the whole school and ensure the security of the campus network.
【学位授予单位】：北京交通大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08;TP393.18

【相似文献】