【摘要】：近些年,互聯網蓬勃發(fā)展,已經滲透到老百姓生活的各個方面,也應用到國家的重要基礎設施,加速了國家的信息化進程。互聯網已經成為人民生活的一部分,不可分割。與此同時,網絡攻擊技術也得到了快速發(fā)展,并且計算機網絡和操作系統的漏洞也借著互聯網平臺更多的暴露出來,使得利用網絡進行違法活動的事件經常發(fā)生,造成不小的經濟損失。因此,及時了解當前網絡的安全狀態(tài),并預測網絡狀態(tài)的發(fā)展趨勢顯得極其重要。此外,單一性質的防護方式已經不能滿足需求,需要綜合考慮多種防護措施之間的關聯性,實現協同防護。為了實現協同防護、趨勢預測,幫助快速、準確的定位異常,本文設計并實現了一個區(qū)域網絡的態(tài)勢預測及可視化系統,通過采集區(qū)域網絡中不同設備相關的多源數據,預處理后進行理解、關聯分析及預測,最終實現可視化,使得網絡攻擊防御由被動變主動,為網絡管理人員分析以及調整防御策略提供強大的支撐。本文圍繞區(qū)域網絡的態(tài)勢預測及可視化技術研究與實現開展了七個重點工作:第一,設計并實現了一套完整的從數據采集、數據分析到數據可視化的態(tài)勢感知預測系統。第二,研究并實現多源異構數據的采集,為系統的核心功能關聯分析和趨勢預測提供強大的數據支撐。第三,研究并實現關聯分析算法,挖掘在區(qū)域網絡中發(fā)生的網絡安全事件之間的關聯規(guī)則,并給出關聯安全事件之間的置信度。第四,分析比較了兩種神經網絡算法的優(yōu)缺點,提出了對RIBF神經網絡的改進方法,使用改進的RBF實現對趨勢的預測,并對比了算法改進前后的預測效果。第五,提出了一種基于大量數據的網絡異常流量的檢測方式,通過對大量流量歷史曲線數據存儲,提取相同行為模式的訓練數據,建立模型曲線。計算觀測流量曲線與模型曲線之間的距離來定位異常發(fā)生的時間范圍。第六,實現了安全數據可視化,給網絡管理人員提供管理安全數據的交互接口。最后對關聯分析模塊和預測模塊進行了功能性測試,以及監(jiān)控端可視化的可用性驗證。本文是態(tài)勢感知預測系統的一個初期呈現,為后來區(qū)域網絡的安全管理與防御做了很好的基礎鋪墊。
[Abstract]:In recent years, the rapid development of the Internet has penetrated into all aspects of people's life, also applied to the important infrastructure of the country, accelerated the process of national information. Internet has become a part of people's life, inseparable. At the same time, the technology of network attack has also developed rapidly, and the loopholes in computer networks and operating systems have been exposed more by the Internet platform, so that the use of the network for illegal activities often occurs. Cause no small economic loss. Therefore, it is very important to know the security state of the current network and predict the development trend of the network state. In addition, the single nature of the protection can not meet the needs of the need for comprehensive consideration of a variety of protective measures between the relevance of the realization of collaborative protection. In order to achieve cooperative protection, trend prediction and help to locate anomalies quickly and accurately, this paper designs and implements a situation prediction and visualization system of regional network, which collects multi-source data related to different devices in regional network. After preprocessing, understanding, association analysis and prediction are carried out, and finally visualization is realized, which makes network attack defense from passive to active, and provides strong support for network managers to analyze and adjust defense strategy. This paper focuses on the research and implementation of situation prediction and visualization technology of regional network. Firstly, it designs and implements a complete situational awareness forecasting system from data acquisition, data analysis to data visualization. Secondly, research and implementation of multi-source heterogeneous data acquisition, for the system's core function of correlation analysis and trend prediction provides a strong data support. Thirdly, we study and implement the association analysis algorithm, mining the association rules between the network security events that occur in the local network, and give the confidence between the associated security events. Fourthly, the advantages and disadvantages of the two neural network algorithms are analyzed and compared, and the improved method of RIBF neural network is put forward, the trend prediction is realized by using the improved RBF, and the prediction results before and after the improved algorithm are compared. Fifth, a network anomaly detection method based on a large amount of data is proposed. By storing a large amount of traffic history curve data, the training data of the same behavior pattern are extracted, and the model curve is established. The distance between the observed flow curve and the model curve is calculated to locate the time range of the anomaly. Sixth, the security data visualization is realized, and the interactive interface for network managers to manage secure data is provided. Finally, the functional tests of the association analysis module and the prediction module are carried out, as well as the visual usability verification of the monitor side. This paper is an initial presentation of situational awareness prediction system, which lays a good foundation for the later regional network security management and defense.
【學位授予單位】：電子科技大學
【學位級別】：碩士
【學位授予年份】：2017
【分類號】：TP393.0

【參考文獻】

相關期刊論文 前10條

1 丁麗;;網絡安全監(jiān)測數據分析——2016年10月[J];互聯網天地;2016年12期

2 李平;;2015年電腦病毒感染突破48億次 病毒成斂財工具[J];計算機與網絡;2016年Z1期

3 席榮榮;云曉春;金舒原;張永錚;;網絡安全態(tài)勢感知研究綜述[J];計算機應用;2012年01期

4 李碩;戴欣;周渝霞;;網絡安全態(tài)勢感知研究進展[J];計算機應用研究;2010年09期

5 韋勇;連一峰;;基于日志審計與性能修正算法的網絡安全態(tài)勢評估模型[J];計算機學報;2009年04期

6 賴積保;王慧強;金爽;;基于Netflow的網絡安全態(tài)勢感知系統研究[J];計算機應用研究;2007年08期

7 王慧強;賴積保;朱亮;梁穎;;網絡態(tài)勢感知系統研究綜述[J];計算機科學;2006年10期

8 劉柏森;劉美佳;秦進平;;RBF網絡在逼近能力方面的探討[J];交通科技與經濟;2006年01期

9 胡華平,張怡,陳海濤,宣蕾,孫鵬;面向大規(guī)模網絡的入侵檢測與預警系統研究[J];國防科技大學學報;2003年01期

10 閆懷志,胡昌振,譚惠民;基于模糊矩陣博弈的網絡安全威脅評估[J];計算機工程與應用;2002年13期

相關碩士學位論文 前1條

1 呂智勇;基于數據挖掘的入侵檢測系統的研究[D];哈爾濱工程大學;2006年

，

本文編號：2187646