【摘要】 随着网络攻击数量和种类的不断增加,基于蜜罐(Honeypot)系统的海量攻击日志分析变得更加困难和耗时。仅仅凭借一个事件推断黑客意图和行为是非常困难的。这就要求在蜜罐系统的研究中进行整体性分析,数据挖掘技术就是这样的整体性分析工具。首先阐述了蜜罐系统的原理,然后以开源蜜罐系统Honeyd捕获的真实日志数据为例,使用关联规则挖掘先验(Apriori)算法对日志的特定属性进行分析,找出不同网络连接记录属性之间的关联规则,从中发现并理解攻击者的攻击行为和攻击模式,验证了数据挖掘技术应用于蜜罐日志分析中的可行性。更多还原

【Abstract】 With the significant increase in amount and type of network attacks,analysis on Honeypot logs with huge volume becomes more difficult and time-consuming,and data mining technology is a tool for analyzing the dataset as whole and for improving the work efficiency. This paper first describes the principle of the Honeypot system. Then the data mining algorithm Apriori is applied to analyzing the attributes of the log data captured by Honeyd-an open source Honeypot solution,and further to identifying data association rules,and then by these rules discovering and understanding hackers’ behaviors. The research work also proves the feasibility of data mining technologies in the field of Honeypot log analysis.更多还原