【作者】 王鑫；

【导师】 杨义先；

【作者基本信息】 北京邮电大学 ， 信息安全， 2018， 硕士

【摘要】 随着网络技术的迅速发展和互联网的广泛应用,新的攻击方式不断出现,网络安全问题更是频繁发生。蜜罐作为一种主动防御技术,已经被广泛应用于网络安全领域。蜜罐除了可以诱捕攻击者对其进行攻击以外,还能详细记录攻击的信息和行为,以便帮助分析入侵者的行为,从而更好地进行防御。由于蜜罐捕获数据的数目巨大,并且存在噪声,因此可以利用数据挖掘算法挖掘数据之间隐藏的关系。传统的K-means算法对噪声数据敏感,并且算法稳定性较低,直接使用该算法对蜜罐捕获数据进行分析,容易生成局部最优解,导致数据分析结果不准确。因此本文提出了一种基于蜜罐的网络防御模型,并对其进行设计与实现。本文具体工作如下:1.本文针对蜜罐自身捕获数据的特性和K-means算法的不足之处,提出了 GDK-means算法。该算法利用网格划分和DBSCAN算法的优势,数据中的噪声点进行过滤,降低噪声数据。同时确定K-means的K值和初始聚类中心,改进传统K-means算法在实际应用中因自身的不稳定性使得聚类结果达到局部最优的状况。2.利用GDK-means算法,设计了一套基于蜜罐的网络防御模型。模型包括数据控制、数据捕获、数据分析和规则提取四个部分。数据分析是本模型的重点,该模块利用改进后K-means算法对蜜罐捕获的数据进行聚类,可以分为正常簇和异常簇,再利用关联规则算法Apriori对异常行为提取强规则。最后根据Snort规则的标准,把生成的强规则转换为Snort规则。3.对模型主要模块的功能进行了实现,包括数据控制、数据捕获、数据分析和规则提取四个模块。搭建基于蜜罐的网络防御模型,并对模型的功能进行测试分析。实验结果显示,各个模块的功能都达到了预期效果。所以该模型可以检测到未知的攻击,并且从一定程度上降低了误报率和漏报率。综上所述,通过本文设计的网络防御模型可以检测到网络中未知的攻击,实现主动防御。更多还原

【Abstract】 With the rapid development of network technology and the wide use of the Internet,new methods of attack continue to emerge,and network security problems frequently occur.As an active defense technology,honeypot has been widely used in the field of network security.In addition to trapping an attacker,the honeypot can also record the information and behavior of the attack in detail to help analyze the intruder’s behavior and better defend.Due to the huge number and the noise of data captured by honeypot,data mining algorithms can be used to mine hidden relationships between data.The traditional K-means algorithm is sensitive to noise data,and the stability of the algorithm is low.Using this algorithm to analyze the data captured by the honeypot,it is easy to generate a local optimal solution,resulting in inaccurate data analysis results.Therefore,this paper proposes a network defense model based honeypot,and designs and implements it.The specific work of this article is as follows:1.This paper proposes the GDK-means algorithm according to the characteristics of the data captured by honeypot and the deficiencies of the K-means algorithm.The algorithm uses the advantages of meshing and DBSCAN algorithms to filter noise points in the data and reduce noise data.At the same time,the K-means K value and the initial clustering center are determined,and the improvement of the traditional K-means algorithm in the practical application results in the clustering result reaching a local optimal state due to its own instabilities.2.Using the GDK-means algorithm,a network defense model based honeypot is designed.The model includes four parts:data control,data capture,data analysis and rule extraction.Data analysis is the focus of this model.This module uses the improved K-means algorithm to cluster the data captured by the honeypot and can be divided into normal clusters and abnormal clusters,and then use the association rules algorithm Apriori to extract strong rules for abnormal behavior.Finally,according to the criteria of Snort rules,the generated strong rules are converted into Snort rules.3.The functions of the main modules of the model were implemented,including four modules:data control,data capture,data analysis,and rule extraction.a network defense model based honeypot was set up,and the functions of the model were tested and analyzed.Experimental results show that the functions of each module have achieved the desired results.Therefore,this model can detect unknown attacks and reduce the false alarm rate and false negative rate to some extent.In summary,the network defense model designed in this paper can detect unknown attacks in the network and implement active defense.更多还原