针对如何从海量的网络流量数据中高效检测出物联网僵尸网络多阶段攻击行为,提出了一种基于多尺度混合残差网络(Multi-scale Hybrid Residual Network,MHRN)的物联网僵尸网络攻击检测(IoT Botnet Attack Detection based on MHRN,IBAD-MH...针对如何从海量的网络流量数据中高效检测出物联网僵尸网络多阶段攻击行为,提出了一种基于多尺度混合残差网络(Multi-scale Hybrid Residual Network,MHRN)的物联网僵尸网络攻击检测(IoT Botnet Attack Detection based on MHRN,IBAD-MHRN)方法。首先,为了减少检测模型的计算参数,在数据预处理中提出基于方差阈值法的特征选择(Feature Selection based on Variance Threshold,FS-VT)算法;其次,采取一种将数据样本转换为图像样本的数据图像化处理策略,充分挖掘深度学习模型的潜能;然后,为了弥补传统僵尸网络检测模型表征能力有限的不足,提出了一种基于多尺度混合残差网络的物联网僵尸网络多阶段攻击检测模型,该模型通过混合方式融合了不同尺度深度提取的特征信息,再通过残差连接消除网络加深造成的网络退化影响;最后,集成上述模型和算法,进一步提出了一种物联网僵尸网络攻击检测方法IBAD-MHRN。实验结果表明,IBAD-MHRN方法的检测准确率和F1值均达到了99.8%,与表现较好的卷积神经网络方法相比在准确率和F1值上分别有0.14%和0.36%的提升,能够有效且高效地检测物联网僵尸网络多阶段攻击。展开更多
With the rapid developments of information technology,various industries become much more dependent on networks.Driven by economic interests and the game between countries reflected by growing cyberspace confrontation...With the rapid developments of information technology,various industries become much more dependent on networks.Driven by economic interests and the game between countries reflected by growing cyberspace confrontations,evasive network attacks on information infrastructures with high-tech,high concealment and longterm sustainability become severe threats to national security.In this paper,we propose a novel two-phased method for the detection of evasive network attacks which exploit or pretend to be common legal encryption services in order to escape security inspection.Malicious communications which camouflage themselves as legal encryption application are identified in the SSL'session structure verification phase firstly,and then by serverside X.509 certificate based anomaly detection,suspicious attack behaviors are further distinguished effectively.Experiment results show that our method is very useful for detecting the network activities of certain unknown threats or new malwares.Besides,the proposed method can be applied to other similar services easily.展开更多
文摘针对如何从海量的网络流量数据中高效检测出物联网僵尸网络多阶段攻击行为,提出了一种基于多尺度混合残差网络(Multi-scale Hybrid Residual Network,MHRN)的物联网僵尸网络攻击检测(IoT Botnet Attack Detection based on MHRN,IBAD-MHRN)方法。首先,为了减少检测模型的计算参数,在数据预处理中提出基于方差阈值法的特征选择(Feature Selection based on Variance Threshold,FS-VT)算法;其次,采取一种将数据样本转换为图像样本的数据图像化处理策略,充分挖掘深度学习模型的潜能;然后,为了弥补传统僵尸网络检测模型表征能力有限的不足,提出了一种基于多尺度混合残差网络的物联网僵尸网络多阶段攻击检测模型,该模型通过混合方式融合了不同尺度深度提取的特征信息,再通过残差连接消除网络加深造成的网络退化影响;最后,集成上述模型和算法,进一步提出了一种物联网僵尸网络攻击检测方法IBAD-MHRN。实验结果表明,IBAD-MHRN方法的检测准确率和F1值均达到了99.8%,与表现较好的卷积神经网络方法相比在准确率和F1值上分别有0.14%和0.36%的提升,能够有效且高效地检测物联网僵尸网络多阶段攻击。
基金supported by the National Science and Technology Support Program under Grant No.2012BAH46B02 and 2012BAH45B01the National High Technology Research and Development Program(863 Program) of China under Grant No.2011AA010703the Strategic Priority Research Program of the Chinese Academy of Sciences under Grant No.XDA06030200
文摘With the rapid developments of information technology,various industries become much more dependent on networks.Driven by economic interests and the game between countries reflected by growing cyberspace confrontations,evasive network attacks on information infrastructures with high-tech,high concealment and longterm sustainability become severe threats to national security.In this paper,we propose a novel two-phased method for the detection of evasive network attacks which exploit or pretend to be common legal encryption services in order to escape security inspection.Malicious communications which camouflage themselves as legal encryption application are identified in the SSL'session structure verification phase firstly,and then by serverside X.509 certificate based anomaly detection,suspicious attack behaviors are further distinguished effectively.Experiment results show that our method is very useful for detecting the network activities of certain unknown threats or new malwares.Besides,the proposed method can be applied to other similar services easily.
