The service and application of a network is a behavioral process that is oriented toward its operations and tasks, whose metrics and evaluation are still somewhat of a rough comparison, This paper describes sce- nes o...The service and application of a network is a behavioral process that is oriented toward its operations and tasks, whose metrics and evaluation are still somewhat of a rough comparison, This paper describes sce- nes of network behavior as differential manifolds, Using the homeomorphic transformation of smooth differential manifolds, we provide a mathematical definition of network behavior and propose a mathe- matical description of the network behavior path and behavior utility, Based on the principle of differen- tial geometry, this paper puts forward the function of network behavior and a calculation method to determine behavior utility, and establishes the calculation principle of network behavior utility, We also provide a calculation framework for assessment of the network＇s attack-defense confrontation on the strength of behavior utility, Therefore, this paper establishes a mathematical foundation for the objective measurement and precise evaluation of network behavior,展开更多
Aiming at the difficulty of unknown Trojan detection in the APT flooding situation, an improved detecting method has been proposed. The basic idea of this method originates from advanced persistent threat （APT） atta...Aiming at the difficulty of unknown Trojan detection in the APT flooding situation, an improved detecting method has been proposed. The basic idea of this method originates from advanced persistent threat （APT） attack intents： besides dealing with damaging or destroying facilities, the more essential purpose of APT attacks is to gather confidential data from target hosts by planting Trojans. Inspired by this idea and some in-depth analyses on recently happened APT attacks, five typical communication characteristics are adopted to describe application’s network behavior, with which a fine-grained classifier based on Decision Tree and Na ve Bayes is modeled. Finally, with the training of supervised machine learning approaches, the classification detection method is implemented. Compared with general methods, this method is capable of enhancing the detection and awareness capability of unknown Trojans with less resource consumption.展开更多
The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing new techniques for analyzing network traffic. If efficient analysis tools ...The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing new techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks and to take action to weaken those attacks appropriately before they have had time to propagate across the network. In this paper, we propose an SNMP MIB oriented approach for detecting attacks, which is based on two-tier GCT by analyzing causal relationship between attacking variable at the attacker and abnormal variable at the target. According to the abnormal behavior at the target, GCT is executed initially to determine preliminary attacking variable, which has whole causality with abnormal variable in network behavior. Depending on behavior feature extracted from abnormal behavior, we can recognize attacking variable by using GCT again, which has local causality with abnormal variable in local behavior. Proactive detecting rules can be constructed with the causality between attacking variable and abnormal variable, which can be used to give alarms in network management system. The results of experiment showed that the approach with two-tier GCT was proved to detect attacks early, with which attack propagation could be slowed through early detection.展开更多
针对当前攻击图模型中很少考虑攻击事件对所有属性节点置信度的动态影响,提出一种基于贝叶斯攻击图的动态风险评估(dynamic risk assessment based on Bayesian attack graphs,DRABAG)模型。该模型运用贝叶斯信念网络建立用于描述攻击...针对当前攻击图模型中很少考虑攻击事件对所有属性节点置信度的动态影响,提出一种基于贝叶斯攻击图的动态风险评估(dynamic risk assessment based on Bayesian attack graphs,DRABAG)模型。该模型运用贝叶斯信念网络建立用于描述攻击行为中多步原子攻击间因果关系的概率攻击图,其中,采用通用漏洞评分系统指标计算漏洞利用成功概率,并利用局部条件概率分布表评估属性节点的静态安全风险;进而结合入侵检测系统观测到的实时攻击事件,运用贝叶斯推理方法对单步攻击行为的后验概率进行动态更新,最终实现对目标网络整体安全性的评估。实验结果表明,该模型可评估动态安全风险和推断攻击路径,为实施安全防护策略提供依据。展开更多
为了能在攻击目标受损之前检测到攻击事件,提出了面向网络行为因果关联的攻击检测方法.该方法基于SNMP管理信息库数据,根据攻击目标的异常行为,首先利用Granger因果关联检验(GCT)从检测变量中挖掘出与异常变量存在整体行为关联的基本攻...为了能在攻击目标受损之前检测到攻击事件,提出了面向网络行为因果关联的攻击检测方法.该方法基于SNMP管理信息库数据,根据攻击目标的异常行为,首先利用Granger因果关联检验(GCT)从检测变量中挖掘出与异常变量存在整体行为关联的基本攻击变量,然后针对异常行为特征再次利用GCT从基本攻击变量中挖掘出与异常变量存在局部行为关联的攻击变量,最后根据攻击变量和异常变量之间的因果关系,构建面向攻击方检测的攻击关联规则.在Trin00 UDP Flood检测实验中,所提方法成功挖掘出攻击变量udp Out Datagram,取得了满意的检测效果.实验结果表明,该方法能够在攻击方检测到攻击事件,为及时阻止攻击过程向攻击目标进一步扩散提供预警.展开更多
为了解决软件定义网络(software defined networking,SDN)架构面临的安全挑战,针对SDN网络架构中的安全审计环节,将传统网络中的安全审计解决方案与SDN网络集中控制的特性相结合,依托Floodlight控制器设计并实现适用于SDN网络环境的安...为了解决软件定义网络(software defined networking,SDN)架构面临的安全挑战,针对SDN网络架构中的安全审计环节,将传统网络中的安全审计解决方案与SDN网络集中控制的特性相结合,依托Floodlight控制器设计并实现适用于SDN网络环境的安全审计系统,包括安全审计事件的收集、分析、存储、响应等功能.提出一种针对分布式拒绝服务(distributed denial of service,DDo S)攻击的攻击回溯算法对安全审计事件进行追溯,确定出DDo S攻击发起者及僵尸主机集合.同时,采用滑动窗口分割算法从安全审计事件中提取出用户行为序列模式,基于Levenshtein算法计算用户行为序列模式之间的相似度,并根据用户当前行为和历史行为的相似度来判断是否出现可疑的攻击行为.经实验验证,该系统能准确地回溯出DDo S攻击发生时被控的僵尸主机集合及攻击者,并且可以有效地检测出用户攻击行为.展开更多
文摘The service and application of a network is a behavioral process that is oriented toward its operations and tasks, whose metrics and evaluation are still somewhat of a rough comparison, This paper describes sce- nes of network behavior as differential manifolds, Using the homeomorphic transformation of smooth differential manifolds, we provide a mathematical definition of network behavior and propose a mathe- matical description of the network behavior path and behavior utility, Based on the principle of differen- tial geometry, this paper puts forward the function of network behavior and a calculation method to determine behavior utility, and establishes the calculation principle of network behavior utility, We also provide a calculation framework for assessment of the network＇s attack-defense confrontation on the strength of behavior utility, Therefore, this paper establishes a mathematical foundation for the objective measurement and precise evaluation of network behavior,
基金Supported by the National Natural Science Foundation of China (61202387, 61103220)Major Projects of National Science and Technology of China(2010ZX03006-001-01)+3 种基金Doctoral Fund of Ministry of Education of China (2012014110002)China Postdoctoral Science Foundation (2012M510641)Hubei Province Natural Science Foundation (2011CDB456)Wuhan Chenguang Plan Project(2012710367)
文摘Aiming at the difficulty of unknown Trojan detection in the APT flooding situation, an improved detecting method has been proposed. The basic idea of this method originates from advanced persistent threat （APT） attack intents： besides dealing with damaging or destroying facilities, the more essential purpose of APT attacks is to gather confidential data from target hosts by planting Trojans. Inspired by this idea and some in-depth analyses on recently happened APT attacks, five typical communication characteristics are adopted to describe application’s network behavior, with which a fine-grained classifier based on Decision Tree and Na ve Bayes is modeled. Finally, with the training of supervised machine learning approaches, the classification detection method is implemented. Compared with general methods, this method is capable of enhancing the detection and awareness capability of unknown Trojans with less resource consumption.
文摘The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing new techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks and to take action to weaken those attacks appropriately before they have had time to propagate across the network. In this paper, we propose an SNMP MIB oriented approach for detecting attacks, which is based on two-tier GCT by analyzing causal relationship between attacking variable at the attacker and abnormal variable at the target. According to the abnormal behavior at the target, GCT is executed initially to determine preliminary attacking variable, which has whole causality with abnormal variable in network behavior. Depending on behavior feature extracted from abnormal behavior, we can recognize attacking variable by using GCT again, which has local causality with abnormal variable in local behavior. Proactive detecting rules can be constructed with the causality between attacking variable and abnormal variable, which can be used to give alarms in network management system. The results of experiment showed that the approach with two-tier GCT was proved to detect attacks early, with which attack propagation could be slowed through early detection.
文摘针对当前攻击图模型中很少考虑攻击事件对所有属性节点置信度的动态影响,提出一种基于贝叶斯攻击图的动态风险评估(dynamic risk assessment based on Bayesian attack graphs,DRABAG)模型。该模型运用贝叶斯信念网络建立用于描述攻击行为中多步原子攻击间因果关系的概率攻击图,其中,采用通用漏洞评分系统指标计算漏洞利用成功概率,并利用局部条件概率分布表评估属性节点的静态安全风险;进而结合入侵检测系统观测到的实时攻击事件,运用贝叶斯推理方法对单步攻击行为的后验概率进行动态更新,最终实现对目标网络整体安全性的评估。实验结果表明,该模型可评估动态安全风险和推断攻击路径,为实施安全防护策略提供依据。
文摘为了能在攻击目标受损之前检测到攻击事件,提出了面向网络行为因果关联的攻击检测方法.该方法基于SNMP管理信息库数据,根据攻击目标的异常行为,首先利用Granger因果关联检验(GCT)从检测变量中挖掘出与异常变量存在整体行为关联的基本攻击变量,然后针对异常行为特征再次利用GCT从基本攻击变量中挖掘出与异常变量存在局部行为关联的攻击变量,最后根据攻击变量和异常变量之间的因果关系,构建面向攻击方检测的攻击关联规则.在Trin00 UDP Flood检测实验中,所提方法成功挖掘出攻击变量udp Out Datagram,取得了满意的检测效果.实验结果表明,该方法能够在攻击方检测到攻击事件,为及时阻止攻击过程向攻击目标进一步扩散提供预警.
文摘为了解决软件定义网络(software defined networking,SDN)架构面临的安全挑战,针对SDN网络架构中的安全审计环节,将传统网络中的安全审计解决方案与SDN网络集中控制的特性相结合,依托Floodlight控制器设计并实现适用于SDN网络环境的安全审计系统,包括安全审计事件的收集、分析、存储、响应等功能.提出一种针对分布式拒绝服务(distributed denial of service,DDo S)攻击的攻击回溯算法对安全审计事件进行追溯,确定出DDo S攻击发起者及僵尸主机集合.同时,采用滑动窗口分割算法从安全审计事件中提取出用户行为序列模式,基于Levenshtein算法计算用户行为序列模式之间的相似度,并根据用户当前行为和历史行为的相似度来判断是否出现可疑的攻击行为.经实验验证,该系统能准确地回溯出DDo S攻击发生时被控的僵尸主机集合及攻击者,并且可以有效地检测出用户攻击行为.
