欢迎您！东篱公司
退出
-
申报数据库
-
立项数据库
-
成果数据库
-
项目获奖数据库
中文摘要：
为了能在攻击目标受损之前检测到攻击事件，提出了面向网络行为因果关联的攻击检测方法．该方法基于SNMP管理信息库数据，根据攻击目标的异常行为，首先利用Granger因果关联检验（GCT）从检测变量中挖掘出与异常变量存在整体行为关联的基本攻击变量，然后针对异常行为特征再次利用GCT从基本攻击变量中挖掘出与异常变量存在局部行为关联的攻击变量，最后根据攻击变量和异常变量之间的因果关系，构建面向攻击方检测的攻击关联规则．在Trin00 UDP Flood检测实验中，所提方法成功挖掘出攻击变量udpOutDatagram，取得了满意的检测效果．实验结果表明，该方法能够在攻击方检测到攻击事件，为及时阻止攻击过程向攻击目标进一步扩散提供预警．
英文摘要：
An SNMP MIB oriented approach based on causality in network behavior is presented in order to detect attack before the security of target is damaged. According to the behavior of an abnormal variable in target, Granger causality test （GCT） is used to find preliminary attacking variables which are causality relevant to the abnormal variable in whole network behavior. Depending on the behavior features hidden in the abnormal behavior, GCT is used again to recognize attacking variables which are causality relevant to the abnormal variable in local network behavior. The causality between attacking variables and the abnormal variable is then used to construct detecting rules, which are oriented to attacker, udpOutDatagrams acting as attacking variable are recognized successfully and detection results are acquired well in the test of Trin00 UDP Flood. The experiment results show that the approach can effectively detect attacks from attackers, which has effect on blocking the pervasion of attacking procedure to target.
同期刊论文项目
同项目期刊论文
期刊信息
位置：