【作者】 曹伟；

【导师】 李双庆；

【作者基本信息】 重庆大学 ， 计算机软件与理论， 2011， 硕士

【摘要】 随着网络技术的日益发展,网络安全问题也变得日益严峻。异常行为检测作为一种积极主动的安全防护技术,在网络系统受到危害之前拦截和响应入侵,对网络主体进行纵深、多层次的防御,受到了研究者的高度重视。目前入侵检测技术多采用专家系统或事后分析的方法,缺乏对入侵行为的在线实时检测能力。网络异常行为分析是从大量的网络信息当中发现网络异常行为,从而能采取一定的安全措施。论文在入侵检测特征与分析的基础上,研究异常行为检测技术,旨在指导在线网络异常行为分析模型和系统的设计。论文主要工作内容如下:①分析了网络异常行检测的重要性,针对入侵行为特征分析了TCP/IP协议,分析了网络的脆弱性以及常见的入侵行为及其特征,为异常行为分析的数据特征提取提供了一定的依据。②研究了当前异常行为检测技术,在基于局部异常值概念的基础上,提出一种无监督的增量的异常行为检测算法,提高了异常检测效果,降低了异常检测的误报率。在该算法的基础上设计了一种异常行为检测模型,该模型实现了在线实时异常行为检测,使得能尽早的发现网络中的异常行为,从而采取一定的安全措施。③在Linux操作系统下,利用Libpcap开源函数库实现了异常行为检测原型系统。该原型系统对网络数据流特征进行实时统计分析,然后对其进行异常行为检测,实时发现网络中的异常行为。通过实验测试,验证了网络异常行为检测模型的有效性和正确性。更多还原

【Abstract】 With the increasing development of network technology, the problem of network security is also becoming increasingly severe. As a proactive safety protection technology, anomaly detection, which intercepts and responds to the intrusion before the network system has been endangered, sets a multi-level defense to protect the network. Anomaly detection has received a lot of researcher’s attention.Most of the intrusion detection system adopts the methods of expert system or ex post analysis currently, which lacks the capability of online real-time intrusion detection. Anomaly analysis detects the abnormal behaviors from a large amount of network information to adopt the corresponding safety protection measures. Based on the study of features and analysis of intrusion detection, this thesis focuses on the research of anomaly detection technology to give a guide line to the design of online network anomaly analysis model and system. The main contents are as follows:①The importance of network anomaly detection has been analyzed, and the TCP / IP protocol have been analyzed aiming at the features of intrusion behaviors. The vulnerability of network and intrusion behaviors which are commonly seen has also been analyzed and their features provide a data characteristics basis for the anomaly analysis.②Based on the study of the current anomaly analysis technology, an unsupervised incremental anomaly analysis algorithm based on local outlier factor is proposed, which improves the effectiveness of anomaly detection and reduces the false rate of anomaly detection. And based on this algorithm, an anomaly analysis detection model was designed, which implements the online real-time detection of anomaly behavior, making the discovery of anomaly behavior as early as possible in order to take certain security measures.③Under the Linux operating system, a prototype system is implemented using the Libpcap open-source function library. The prototype system carries out real-time statistical analysis to the features of network traffic, and then detects the anomaly behaviors to find the network anomaly behaviors in real-time. The effectiveness and correctness of network anomaly analysis model is tested and verified through experimental tests.更多还原