【作者】 钱杰；

【导师】 龚俭； 王晨；

【作者基本信息】 东南大学 ， 计算机技术（专业学位）， 2022， 硕士

【摘要】 随着互联网的蓬勃发展,网络安全问题日益凸显。作为互联网关键基础资源,域名承载着互联网向用户提供的形形色色的网络服务,对这些服务实现有效监测,对于保障网络的安全可靠运行具有非常重要的意义。本文根据网络安全态势感知的任务要求,在CERNET原有安全保障系统的基础上,对DNS服务监测工作进行改进和完善,最终实现对江苏教育网内服务的特征发现,助力CERNET安全态势感知建设。为了从域名流量中找出所有代表服务的域名,本文设计了一个主从域名识别算法。该算法可以较为准确地对域名流量中的主域名和从域名进行区分,从而筛选出有服务意义的主域名作为后续特征发现的对象,提高服务监测的准确性和效率。为了获取这些主域名所标识的服务的行为信息,本文以安全保障系统下IP活动库提供的流记录为数据源,选取服务时间、服务空间、服务对象、服务强度、数据交互、服务节律作为特征提取的六个维度,基于这些维度共计提出了18个行为特征测度,并设计了这些测度对应的测量方法。一个服务测得的测度值集合构成该服务的行为特征集,用来反映服务的活动状况。为了更直观地体现服务的特点,本文从用户画像中获得启发,设计了一个标签体系,从不同行为特性的角度对行为特征集中的测度值进行组合并重新分类。通过选取合适的标签并按层级组织,合理划分标签语义以及研究服务信息到标签具体语义的良好映射,最终完成了标签体系的构建,从而实现了对服务活动特点的展示。最后,论文设计并实现了网络服务行为特征观测系统。该系统将上述研究分别应用于服务及服务资源识别、服务行为特征提取和服务行为特征表达模块,同时向用户提供了查询功能,实现了对被管网内服务的有效监测。更多还原

【Abstract】 With the vigorous development of the Internet,network security issues have become increasingly prominent.As a key basic resource of the Internet,domain names carry various network services provided by the Internet to users.Effective monitoring of these services is of great significance to ensure the safe and reliable operation of the network.According to the task requirements of network security situational awareness,on the basis of CERNET’s original security assurance system,this paper improves and perfects the DNS service monitoring work,and finally realizes the feature discovery of services in Jiangsu Education Network,which helps CERNET’s security situational awareness construction.In order to find out all the domain names representing the service from the domain name traffic,this paper designs a master-slave domain name identification algorithm.The algorithm can more accurately distinguish the primary domain name and secondary domain name in the domain name traffic,so as to screen out the primary domain name with service significance as the object of subsequent feature discovery,and improve the accuracy and efficiency of service monitoring.In order to obtain the behavior information of the services identified by these primary domain names,this paper takes the flow records provided by the IP activity database under the security assurance system as the data source,and selects service time,service space,service objects,service strength,data interaction,and service rhythm as features.Based on the extracted six dimensions,a total of 18 behavioral feature measures are proposed based on these dimensions,and the corresponding measurement methods for these measures are designed.The set of measure values measured by a service constitutes the behavioral feature set of the service,which is used to reflect the activity status of the service.In order to reflect the characteristics of the service more intuitively,this paper draws inspiration from user portraits and designs a labeling system to combine and reclassify the measurement values in the behavior feature set from the perspective of different behavior characteristics.By selecting appropriate tags and organizing them hierarchically,reasonably dividing tag semantics and studying the good mapping of service information to specific tag semantics,the construction of tag system is finally completed,thus realizing the display of service activity characteristics.Finally,the paper designs and implements a network service behavior characteristic observation system.The system applies the above research to service and service resource identification,service behavior feature extraction and service behavior feature expression modules,and provides users with query functions to effectively monitor services in the managed network.更多还原