基于网络通信异常识别的多步攻击检测方法

琚安康; 郭渊博; 李涛; 叶子维

doi:10.11959/j.issn.1000-436x.2019142

您当前的位置：

首页 >

文章列表页 >

基于网络通信异常识别的多步攻击检测方法

学术论文 | 更新时间：2024-06-05

- 基于网络通信异常识别的多步攻击检测方法
- Multi-step attack detection method based on network communication anomaly recognition
- 通信学报 2019年40卷第7期页码：57-66
- 作者机构：
  
  战略支援部队信息工程大学密码工程学院，河南郑州 450001
- 作者简介：
  
  [ "琚安康（1995- ），男，河南辉县人，战略支援部队信息工程大学博士生，主要研究方向为多步攻击检测、异构安全数据融合。" ]
  [ "郭渊博（1975- ），男，陕西周至人，博士，战略支援部队信息工程大学教授、博士生导师，主要研究方向为大数据安全、态势感知。" ]
  [ "李涛（1992- ），男，甘肃甘谷人，战略支援部队信息工程大学博士生，主要研究方向为网络威胁语义建模。" ]
  [ "叶子维（1990- ），男，吉林通化人，战略支援部队信息工程大学博士生，主要研究方向为网络安全、态势感知。" ]
- 基金信息：
  
  国家自然科学基金资助项目(61501515)
- DOI：10.11959/j.issn.1000-436x.2019142
  中图分类号： TP309
- 网络出版日期：2019-07，
  
  纸质出版日期：2019-07-25
- 稿件说明：
移动端阅览
琚安康, 郭渊博, 李涛, 等. 基于网络通信异常识别的多步攻击检测方法[J]. 通信学报, 2019,40(7):57-66.

Ankang JU, Yuanbo GUO, Tao LI, et al. Multi-step attack detection method based on network communication anomaly recognition[J]. Journal on communications, 2019, 40(7): 57-66.
琚安康, 郭渊博, 李涛, 等. 基于网络通信异常识别的多步攻击检测方法[J]. 通信学报, 2019,40(7):57-66. DOI： 10.11959/j.issn.1000-436x.2019142.

Ankang JU, Yuanbo GUO, Tao LI, et al. Multi-step attack detection method based on network communication anomaly recognition[J]. Journal on communications, 2019, 40(7): 57-66. DOI： 10.11959/j.issn.1000-436x.2019142.

摘要

针对企业内部业务逻辑固定、进出网络访问行为受控等特点，首先定义了2类共4种异常行为，然后提出了基于网络通信异常识别的多步攻击检测方法。针对异常子图和异常通信边2类异常，分别采用基于图的异常分析和小波分析方法识别网络通信过程中的异常行为，并通过异常关联分析检测多步攻击。分别在DARPA 2000数据集和LANL数据集上进行实验验证，实验结果表明，所提方法可以有效检测并重构出多步攻击场景。所提方法可有效监测包括未知特征攻击类型在内的多步攻击，为检测 APT 等复杂的多步攻击提供了一种可行思路，并且由于网络通信图大大减小了数据规模，因此适用于大规模企业网络环境。

Abstract

In view of the characteristics of internal fixed business logic

inbound and outbound network access behavior

two classes and four kinds of abnormal behaviors were defined firstly

and then a multi-step attack detection method was proposed based on network communication anomaly recognition.For abnormal sub-graphs and abnormal communication edges detection

graph-based anomaly analysis and wavelet analysis method were respectively proposed to identify abnormal behaviors in network communication

and detect multi-step attacks through anomaly correlation analysis.Experiments are carried out on the DARPA 2000 data set and LANL data set to verify the results.The experimental results show that the proposed method can effectively detect and reconstruct multi-step attack scenarios.The proposed method can effectively monitor multi-step attacks including unknown feature types.It provides a feasible idea for detecting complex multi-step attack patterns such as APT.And the network communication graph greatly reduces the data size

it is suitable for large-scale enterprise network environments.

关键词

Keywords

references

NAVARRO J , DERUYVER A , PARREND P . A systematic survey on multi-step attack detection [J ] . Computers ＆ Security , 2018 , 76 ( 6 ): 214 - 249 .

王莉 . 网络多步攻击识别方法研究 [D ] . 武汉:华中科技大学 , 2007 .

WANG L . Study on method of network multi-stage attack plan recognition [D ] . Wuhan:Huazhong University of Science and Technology , 2007 .

GREGORIO-DE S I , BERK V H , GIANI A , et al . Detection of complex cyber attacks [C ] // Sensors,and Command,Control,Communications,and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense V . International Society for Optics and Photonics , 2006 : 6201 - 6209 .

CHEN P , DESMET L , HUYGENS C . Study on advanced persistent threats [M ] . Berlin : SpringerPress , 2014 : 63 - 72 .

MA Z , SMITH P . Determining risks from advanced multi-step attacks to critical information infrastructures [C ] // International Workshop on Critical Information Infrastructures Security . Springer , 2013 : 142 - 154 .

HOLGADO P , VILLAGRA V A , VAZQUEZ L . Real-time multistep attack prediction based on hidden Markov models [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2017 ,PP( 99 ):1.

刘威歆 , 郑康锋 , 武斌 , 等 . 基于攻击图的多源告警关联分析方法 [J ] . 通信学报 , 2015 , 36 ( 9 ): 135 - 144 .

LIU W X , ZHENG K D , WU B , et al . Alert processing based on attack graph and multi-source analyzing [J ] . Journal on Communications , 2015 , 36 ( 9 ): 135 - 144 .

ELSHOUSH H T , OSMAN I M . Alert correlation in collaborative intelligent intrusion detection systems-a survey [J ] . Applied Soft Computing , 2011 , 11 ( 7 ): 4349 - 4365 .

WANG L , ISLAM T , LONG T , et al . Attack graph-based probabilistic security metric [C ] // XXII,IFIP WG 11.3 Working Conference on Data and Applications Security . DBLP , 2008 : 283 - 296 .

AKOGLU L , TONG H , KOUTRA D . Graph based anomaly detection and description:a survey [J ] . Data Mining and Knowledge Discovery , 2015 , 29 ( 3 ): 626 - 688 .

HUTCHINS E M , CLOPPERT M J , AMIN R M . Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains [J ] . Leading Issues in Information Warfare ＆ Security Research , 2011 , 1 ( 1 ):80.

KIM Y H , PARK W H . A study on cyber threat prediction based on intrusion detection event for APT attack detection [J ] . Multimedia Tools and Applications , 2014 , 71 ( 2 ): 685 - 698 .

NEIL J , HASH C , BRUGH A , et al . Scan statistics for the onlinedetection of locally anomalous subgraphs [J ] . Technometrics , 2013 , 55 ( 4 ): 403 - 414 .

NEIL J , STORLIE C . Statistical detection of intruders within computer networks using scan statistics [M ] . London : Imperial College PressPress , 2014 : 71 - 104 .

钱叶魁 , 陈鸣 , 叶立新 , 等 . 基于多尺度主成分分析的全网络异常检测方法 [J ] . 软件学报 , 2012 ( 2 ): 361 - 377 .

QIAN Y Q , CHEN M , YE L X , et al . Network-wide anomaly detection method based on multiscale principal component analysis [J ] . Journal of Software , 2012 ( 2 ): 361 - 377 .

MCHUGH J . Testing intrusion detection systems:a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by lincoln laboratory [J ] . ACM Transactions on Information and System Security , 2000 , 3 ( 4 ): 262 - 294 .

KENT A D . Cyber security data sources for dynamic network research [M ] . World Scientific Publishing . 2016 : 37 - 65

CSUBÁK D , SZÜCS K , VÖRÖS P , et al . big data testbed for network attack detection [J ] . Acta Polytechnica Hungarica , 2016 , 13 ( 2 ): 47 - 57

浏览量

1449

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向多步攻击的网络安全态势评估方法

基于警报序列聚类的多步攻击模式发现研究