中文摘要：

主动防御是当今网络安全研究领域的一个热点,现有的主动防御技术主要从网络层和传输层的角度来防御攻击.由于新出现的网络攻击主要发生在应用层,这类攻击在网络层和传输层的数据流与正常数据流没有显著区别,导致现有的主动防御技术无法有效应对这一类攻击,因此研究有效的应用层主动防御具有重要的意义.文中提出一种基于隐半马尔可夫模型的应用层风险实时评估方法,该方法通过分析网络中的实时数据流来评估应用层风险.基于上述风险实时评估方法和应用层协议分析,提出一种应用层实时主动防御系统,当系统发现用户的应用层协议行为存在风险时,该系统根据用户行为的风险值对其产生的数据包进行排队控制,自动纠正用户的异常行为,实现应用层主动防御.实验结果表明该系统具有良好的实时主动防御性能.

英文摘要：

Proactive defense is a prevalent isting proactive defense techniques mainly topic in current research field of network security. Exdetect attacks from network layer and transport layer. Since most new attacks are based on application layer protocols and don＇t present significant difference in network traffic, it is difficult for existing proactive defense techniques to effectively detect such application layer attacks without special techniques. Therefore, the research on proactive defense of application layer becomes very important. This paper presents a risk real-time evaluation method for application layer based on hidden semi-Markov model. This method evaluates the application layer risk by analyzing network traffic. Based on this risk evaluation method and application layer protocol analysis, this paper presents a real-time proactive defense system for application layer. When user＇s behavior is at risk, the system queues the user＇s packets according to the risk indicator. By this means, the proposed system can automatically restrict each user＇s anomalous behavior, and achieve the application layer proactive defense. The final experiment results validate the performance of the system.