基于時空主成分分析的惡意加密流量檢測技術(shù)*
網(wǎng)絡安全與數(shù)據(jù)治理 10期
孟 楠,,周成勝,,趙 勛,,王 斌,,姜喬木
(1.中國信息通信研究院安全研究所,,北京100191,;2.廣州匯智通信技術(shù)有限公司,,廣東廣州510639)
摘要: 惡意加密流量檢測對關(guān)鍵信息基礎設施的可靠運行至關(guān)重要,,也是應對DDoS攻擊等網(wǎng)絡威脅的有效手段,。利用時空主成分分析技術(shù),,構(gòu)建了時間維度和空間維度的網(wǎng)絡流量變化模型,實現(xiàn)惡意加密流量的實時檢測和追蹤溯源,。在時間維度,,利用歷史積累的網(wǎng)絡流量監(jiān)測信息進行主成分分析,構(gòu)建瞬時流量預測模型與實際監(jiān)測流量之間的平方預測誤差,判定網(wǎng)絡中出現(xiàn)惡意加密流量的時刻,。在空間維度,,利用歷史積累的各國家和地區(qū)的網(wǎng)絡流量監(jiān)測數(shù)據(jù),構(gòu)建區(qū)域流量預測模型與實際監(jiān)測流量之間的平方預測誤差,,對惡意加密流量的來源地進行追蹤溯源,。最后,設計了一種可用于現(xiàn)網(wǎng)部署的算法實現(xiàn)流程,,并分析了相比其他已有算法帶來的能力提升,。
中圖分類號:TP393.08
文獻標識碼:A
DOI:10.19358/j.issn.2097-1788.2023.10.006
引用格式:孟楠,周成勝,,趙勛,,等.基于時空主成分分析的惡意加密流量檢測技術(shù)[J].網(wǎng)絡安全與數(shù)據(jù)治理,2023,,42(10):33-39.
文獻標識碼:A
DOI:10.19358/j.issn.2097-1788.2023.10.006
引用格式:孟楠,周成勝,,趙勛,,等.基于時空主成分分析的惡意加密流量檢測技術(shù)[J].網(wǎng)絡安全與數(shù)據(jù)治理,2023,,42(10):33-39.
Detection of malicious encrypted network traffic based on temporal and spatial principal component analysis
Meng Nan1,,Zhou Chengsheng1,Zhao Xun 1,,Wang Bin 2,,Jiang Qiaomu 2
(1.Institute of Security, The China Academy of Information and Communications Technology, Beijing 100191, China; 2.Guangzhou Intelligence Communication Technology Co., Ltd., Guangzhou 510639, China)
Abstract: Monitoring and warning of malicious encrypted network traffic is essential for the reliability of critical information infrastructure, which is also an effective method against cyberattacks, such as Distributed Denial of Service (DDoS) attacks. In this paper, malicious encrypted network traffic is monitored and traced by constructing the temporal and spatial network traffic variation model with the Principal Component Analysis (PCA) technique. From a temporal perspective, the PCA technique is operated on historical network traffic monitoring information to construct the Squared Prediction Error (SPE) between temporal model prediction and the measurement of network traffic. The moment that malicious encrypted network traffic behavior occurs can be declared as instantaneous SPE exceeds the predefined threshold. From a spatial perspective, the PCA technique is operated on historical network traffic monitoring information of various countries and regions. The source region of malicious encrypted network traffic can be traced by evaluating the SPE between the spatial model prediction and the measurement of network traffic of each country or region. Finally, a practical algorithm for malicious encrypted network traffic behavior detection is designed. The capacity improvement of the proposed algorithm comparing with existing algorithms is analyzed.
Key words : temporal and spatial principal component analysis; monitoring of malicious encrypted network traffic; trace; squared prediction error
0 引言
隨著互聯(lián)網(wǎng)、大數(shù)據(jù),、云計算等新興信息技術(shù)的快速發(fā)展,,網(wǎng)絡規(guī)模呈現(xiàn)指數(shù)級、爆發(fā)式增長趨勢,,社會各行各業(yè)開始廣泛地應用互聯(lián)網(wǎng)技術(shù)開展工作,,網(wǎng)絡的穩(wěn)定可靠運行對社會平穩(wěn)運行和快速發(fā)展具有重要意義。
為保障網(wǎng)絡穩(wěn)定可靠運行,,需要通過部署網(wǎng)絡流量監(jiān)測設備(如流量探針)對特定網(wǎng)絡出入口的流量進行多維度實時監(jiān)測,,將關(guān)鍵網(wǎng)絡節(jié)點的流量數(shù)據(jù)通過鏡像或分光的方式進行采集,并發(fā)送至網(wǎng)絡安全分析監(jiān)測系統(tǒng),,然后對網(wǎng)絡流量行為、傳輸協(xié)議和數(shù)據(jù)內(nèi)容進行深度包解析,,通過與內(nèi)置的安全威脅情報庫進行匹配,,從而對惡意加密流量行為實現(xiàn)實時檢測和預警[1]。
本文詳細內(nèi)容請下載:http://forexkbc.com/resource/share/2000005736
作者信息:
孟楠1,,周成勝1,,趙勛1,王斌2,,姜喬木2
(1.中國信息通信研究院安全研究所,,北京100191;2.廣州匯智通信技術(shù)有限公司,廣東廣州510639)
此內(nèi)容為AET網(wǎng)站原創(chuàng),,未經(jīng)授權(quán)禁止轉(zhuǎn)載,。