摘要
近年来国内外发生多起大规模网络攻击和泄露事件,同时零日攻击、高级持续威胁(APT)等攻击方式的出现和日益普遍,促使基于全面多阶段的网络杀伤链的网络安全防护架构产生并迅速被众多厂商采用和推广,该架构中对主机网络异常行为的分析成为对恶意软件的大量变种入侵后及时检测的关键技术。以往的异常行为分析模型算法单一,缺乏对间接维度、时序关联的考虑。文章提出一种自适应网络异常的数据分析模型,可分析具有单一特性和分布特性的网络维度,并考虑了时间和时域多周期对网络维度的影响。应用该模型的产品易于管理,异常和攻击行为识别准确,可较好地提升网络杀伤链的分析准确性。
Recently, due to the occurrence of a series of large scale of attack and data leaking affections, and the common of zero-day and APT attacks, the networking security architecture using cyber kill chain based on multi-stages emerges and is widely used in industry. The network abnormal behavior analysis is the key technology to detect the mass variants of malwares that intrude in the architecture. Most of existing abnormal behavior analysis models uses the simple algorithm without considering temporal association, indirect dimension, etc. This paper proposes an adaptive networking abnormal analysis model which applies into single and distribution dimensions, and considers time and periodic affections. This model has better usability and more accurate abnormal detection results, and can help a lot on overall analysis results by using cyber kill chain.
出处
《信息网络安全》
2015年第9期15-19,共5页
Netinfo Security
