与传统的基于低层协议的DDoS攻击相比,应用层DDoS具有更加显著的攻击效果,而且更加难以检测。现有的解决方法包括:特征检测、流量限制、隐半马尔可夫模型等。这些方法在检测应用层DDoS攻击(如,HTTP Get Flood)攻击时检测率不高或者检测...与传统的基于低层协议的DDoS攻击相比,应用层DDoS具有更加显著的攻击效果,而且更加难以检测。现有的解决方法包括:特征检测、流量限制、隐半马尔可夫模型等。这些方法在检测应用层DDoS攻击(如,HTTP Get Flood)攻击时检测率不高或者检测速度较慢。提出的基于用户浏览行为的检测方法对HTTPFlood攻击检测效果明显得到改善。展开更多
面对域名系统(DNS)协议容易被用于恶意活动的问题,提出一种基于DoH(DNS over HTTPS)流量与域名访问活动的用户上网异常行为检测算法,用来对多种DoH相关的异常行为进行检测。同时,研究检测时间窗口的自适应调整方法,使得算法的总体检测...面对域名系统(DNS)协议容易被用于恶意活动的问题,提出一种基于DoH(DNS over HTTPS)流量与域名访问活动的用户上网异常行为检测算法,用来对多种DoH相关的异常行为进行检测。同时,研究检测时间窗口的自适应调整方法,使得算法的总体检测准确率与检测效率之间取得平衡。实验说明,所提算法的准确率、精确率和召回率分别为0.982、0.983与0.981,优于AdaBoost、C4.5、K-近邻算法(KNN)等常见机器学习算法,一定程度上解决了先前方法中算法性能与资源消耗平衡问题,可以帮助管理者完善原有基于DNS的局域网监管策略。展开更多
The rapid development of mobile network brings opportunities for researchers to analyze user behaviors based on largescale network traffic data. It is important for Internet Service Providers(ISP) to optimize resource...The rapid development of mobile network brings opportunities for researchers to analyze user behaviors based on largescale network traffic data. It is important for Internet Service Providers(ISP) to optimize resource allocation and provide customized services to users. The first step of analyzing user behaviors is to extract information of user actions from HTTP traffic data by multi-pattern URL matching. However, the efficiency is a huge problem when performing this work on massive network traffic data. To solve this problem, we propose a novel and accurate algorithm named Multi-Pattern Parallel Matching(MPPM) that takes advantage of HashMap in data searching for extracting user behaviors from big network data more effectively. Extensive experiments based on real-world traffic data prove the ability of MPPM algorithm to deal with massive HTTP traffic with better performance on accuracy, concurrency and efficiency. We expect the proposed algorithm and it parallelized implementation would be a solid base to build a high-performance analysis engine of user behavior based on massive HTTP traffic data processing.展开更多
User interactive behaviors play a dual role during the hypertext transfer protocol （HTTP） video service： reflection and influence. However, they are seldom taken into account in practices. To this end, this paper p...User interactive behaviors play a dual role during the hypertext transfer protocol （HTTP） video service： reflection and influence. However, they are seldom taken into account in practices. To this end, this paper puts forward the user interactive behaviors, as subjective factors of quality of experience （QoE） from viewer level, to structure a comprehensive multilayer evaluation model based on classic network quality of service （QoS） and application QoS. First, dual roles of user behaviors are studied and the characteristics are extracted where the user experience is correlated with user interactive behaviors. Furthermore, we categorize QoE factors into three dimensions and build the metric system. Then we perform the subjective tests and investigate the relationships among network path quality, user behaviors, and QoE. Ultimately, we employ the back propagation neural network （BPNN） to validate our analysis and model. Through the simulation experiment of mathematical and BPNN, the dual effects of user interaction behaviors on the reflection and influence of QoE in the video stream are analyzed, and the QoE metric system and evaluation model are established.展开更多
文摘与传统的基于低层协议的DDoS攻击相比,应用层DDoS具有更加显著的攻击效果,而且更加难以检测。现有的解决方法包括:特征检测、流量限制、隐半马尔可夫模型等。这些方法在检测应用层DDoS攻击(如,HTTP Get Flood)攻击时检测率不高或者检测速度较慢。提出的基于用户浏览行为的检测方法对HTTPFlood攻击检测效果明显得到改善。
文摘面对域名系统(DNS)协议容易被用于恶意活动的问题,提出一种基于DoH(DNS over HTTPS)流量与域名访问活动的用户上网异常行为检测算法,用来对多种DoH相关的异常行为进行检测。同时,研究检测时间窗口的自适应调整方法,使得算法的总体检测准确率与检测效率之间取得平衡。实验说明,所提算法的准确率、精确率和召回率分别为0.982、0.983与0.981,优于AdaBoost、C4.5、K-近邻算法(KNN)等常见机器学习算法,一定程度上解决了先前方法中算法性能与资源消耗平衡问题,可以帮助管理者完善原有基于DNS的局域网监管策略。
基金supported in part by National Natural Science Foundation of China(61671078)the Director Funds of Beijing Key Laboratory of Network System Architecture and Convergence(2017BKL-NSACZJ-06)
文摘The rapid development of mobile network brings opportunities for researchers to analyze user behaviors based on largescale network traffic data. It is important for Internet Service Providers(ISP) to optimize resource allocation and provide customized services to users. The first step of analyzing user behaviors is to extract information of user actions from HTTP traffic data by multi-pattern URL matching. However, the efficiency is a huge problem when performing this work on massive network traffic data. To solve this problem, we propose a novel and accurate algorithm named Multi-Pattern Parallel Matching(MPPM) that takes advantage of HashMap in data searching for extracting user behaviors from big network data more effectively. Extensive experiments based on real-world traffic data prove the ability of MPPM algorithm to deal with massive HTTP traffic with better performance on accuracy, concurrency and efficiency. We expect the proposed algorithm and it parallelized implementation would be a solid base to build a high-performance analysis engine of user behavior based on massive HTTP traffic data processing.
基金supported by the Postdoctoral Science Foundation of China (2017M610827)
文摘User interactive behaviors play a dual role during the hypertext transfer protocol （HTTP） video service： reflection and influence. However, they are seldom taken into account in practices. To this end, this paper puts forward the user interactive behaviors, as subjective factors of quality of experience （QoE） from viewer level, to structure a comprehensive multilayer evaluation model based on classic network quality of service （QoS） and application QoS. First, dual roles of user behaviors are studied and the characteristics are extracted where the user experience is correlated with user interactive behaviors. Furthermore, we categorize QoE factors into three dimensions and build the metric system. Then we perform the subjective tests and investigate the relationships among network path quality, user behaviors, and QoE. Ultimately, we employ the back propagation neural network （BPNN） to validate our analysis and model. Through the simulation experiment of mathematical and BPNN, the dual effects of user interaction behaviors on the reflection and influence of QoE in the video stream are analyzed, and the QoE metric system and evaluation model are established.
