基于时空特性的恶意流量生成方法的研究与实现

A malicious traffic simulation approach based on time and space features

建设网络靶场具有重大战略意义,为了使网络靶场更加逼真地模拟真实环境,需要在其中模拟产生真实网络中必然存在着的恶意流量。论文在对网络恶意流量的空间和时间特征分析的基础之上,提出一种基于时空特性的网络恶意流量生成方法。将用于入侵检测系统的Snort规则库反向解析翻译成脚本,用以构建恶意流量的空间特征。选用泊松模型,模拟恶意流量数据包的到达速率,模拟其时间特征。最后借助Libnet函数库,依据时间特性发送构造好的数据报文,模拟产生网络恶意流量。实验表明,这种方法模拟产生的恶意流量符合真实流量特性,并且可以定制产生特定行为模式的恶意流量。

It is of great importance in constructing the Cyber Range.To make the Cyber Range morerealistic,simulating the inevitable malicious traffic in the real network is very essential.An approach ofsimulating the malicious traffic based on time and space feathers is brought out in this paper.Snort Rulesare reversely used to construct the spatial features and Poisson Model is applied to modeling the temporalcharacteristics.Finally,the packets are sent by Libnet.Experimental results indicate that the trafficgenerated by the proposed method satisfies the properties of the real one.Further more,it can be used togenerate some specific pattern of traffic.