基于网络通信异常识别的多步攻击检测方法
Multi-step attack detection method based on network communication anomaly recognition
- 通信学报 2019年40卷第7期 页码：57-66
- 作者机构：
战略支援部队信息工程大学密码工程学院，河南 郑州 450001
- 作者简介：
[ "琚安康（1995- ），男，河南辉县人，战略支援部队信息工程大学博士生，主要研究方向为多步攻击检测、异构安全数据融合。" ]
[ "郭渊博（1975- ），男，陕西周至人，博士，战略支援部队信息工程大学教授、博士生导师，主要研究方向为大数据安全、态势感知。" ]
[ "李涛（1992- ），男，甘肃甘谷人，战略支援部队信息工程大学博士生，主要研究方向为网络威胁语义建模。" ]
[ "叶子维（1990- ），男，吉林通化人，战略支援部队信息工程大学博士生，主要研究方向为网络安全、态势感知。" ]
- 基金信息：国家自然科学基金资助项目(61501515)
DOI：10.11959/j.issn.1000-436x.2019142
中图分类号： TP309-
网络首发：2019-07，
纸质出版：2019-07-25
- 稿件说明：
移动端阅览
琚安康, 郭渊博, 李涛, 等. 基于网络通信异常识别的多步攻击检测方法[J]. 通信学报, 2019,40(7):57-66.
Ankang JU, Yuanbo GUO, Tao LI, et al. Multi-step attack detection method based on network communication anomaly recognition[J]. Journal on Communications, 2019, 40(7): 57-66.
琚安康, 郭渊博, 李涛, 等. 基于网络通信异常识别的多步攻击检测方法[J]. 通信学报, 2019,40(7):57-66. DOI： 10.11959/j.issn.1000-436x.2019142.
Ankang JU, Yuanbo GUO, Tao LI, et al. Multi-step attack detection method based on network communication anomaly recognition[J]. Journal on Communications, 2019, 40(7): 57-66. DOI： 10.11959/j.issn.1000-436x.2019142.
摘要
针对企业内部业务逻辑固定、进出网络访问行为受控等特点，首先定义了2类共4种异常行为，然后提出了基于网络通信异常识别的多步攻击检测方法。针对异常子图和异常通信边2类异常，分别采用基于图的异常分析和小波分析方法识别网络通信过程中的异常行为，并通过异常关联分析检测多步攻击。分别在DARPA 2000数据集和LANL数据集上进行实验验证，实验结果表明，所提方法可以有效检测并重构出多步攻击场景。所提方法可有效监测包括未知特征攻击类型在内的多步攻击，为检测 APT 等复杂的多步攻击提供了一种可行思路，并且由于网络通信图大大减小了数据规模，因此适用于大规模企业网络环境。
Abstract
In view of the characteristics of internal fixed business logic
inbound and outbound network access behavior
two classes and four kinds of abnormal behaviors were defined firstly
and then a multi-step attack detection method was proposed based on network communication anomaly recognition.For abnormal sub-graphs and abnormal communication edges detection
graph-based anomaly analysis and wavelet analysis method were respectively proposed to identify abnormal behaviors in network communication
and detect multi-step attacks through anomaly correlation analysis.Experiments are carried out on the DARPA 2000 data set and LANL data set to verify the results.The experimental results show that the proposed method can effectively detect and reconstruct multi-step attack scenarios.The proposed method can effectively monitor multi-step attacks including unknown feature types.It provides a feasible idea for detecting complex multi-step attack patterns such as APT.And the network communication graph greatly reduces the data size
it is suitable for large-scale enterprise network environments.
关键词
Keywords
references
NAVARRO J , DERUYVER A , PARREND P . A systematic survey on multi-step attack detection [J ] . Computers ＆ Security , 2018 , 76 ( 6 ): 214 - 249 .
王莉 . 网络多步攻击识别方法研究 [D ] . 武汉:华中科技大学 , 2007 .
WANG L . Study on method of network multi-stage attack plan recognition [D ] . Wuhan:Huazhong University of Science and Technology , 2007 .
GREGORIO-DE S I , BERK V H , GIANI A , et al . Detection of complex cyber attacks [C ] // Sensors,and Command,Control,Communications,and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense V . International Society for Optics and Photonics , 2006 : 6201 - 6209 .
CHEN P , DESMET L , HUYGENS C . Study on advanced persistent threats [M ] . Berlin : SpringerPress , 2014 : 63 - 72 .
MA Z , SMITH P . Determining risks from advanced multi-step attacks to critical information infrastructures [C ] // International Workshop on Critical Information Infrastructures Security . Springer , 2013 : 142 - 154 .
HOLGADO P , VILLAGRA V A , VAZQUEZ L . Real-time multistep attack prediction based on hidden Markov models [J ] . IEEE Transactions on Dependable ＆ Secure Computing , 2017 ,PP( 99 ):1.
刘威歆 , 郑康锋 , 武斌 , 等 . 基于攻击图的多源告警关联分析方法 [J ] . 通信学报 , 2015 , 36 ( 9 ): 135 - 144 .
LIU W X , ZHENG K D , WU B , et al . Alert processing based on attack graph and multi-source analyzing [J ] . Journal on Communications , 2015 , 36 ( 9 ): 135 - 144 .
ELSHOUSH H T , OSMAN I M . Alert correlation in collaborative intelligent intrusion detection systems-a survey [J ] . Applied Soft Computing , 2011 , 11 ( 7 ): 4349 - 4365 .
WANG L , ISLAM T , LONG T , et al . Attack graph-based probabilistic security metric [C ] // XXII,IFIP WG 11.3 Working Conference on Data and Applications Security . DBLP , 2008 : 283 - 296 .
AKOGLU L , TONG H , KOUTRA D . Graph based anomaly detection and description:a survey [J ] . Data Mining and Knowledge Discovery , 2015 , 29 ( 3 ): 626 - 688 .
HUTCHINS E M , CLOPPERT M J , AMIN R M . Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains [J ] . Leading Issues in Information Warfare ＆ Security Research , 2011 , 1 ( 1 ):80.
KIM Y H , PARK W H . A study on cyber threat prediction based on intrusion detection event for APT attack detection [J ] . Multimedia Tools and Applications , 2014 , 71 ( 2 ): 685 - 698 .
NEIL J , HASH C , BRUGH A , et al . Scan statistics for the onlinedetection of locally anomalous subgraphs [J ] . Technometrics , 2013 , 55 ( 4 ): 403 - 414 .
NEIL J , STORLIE C . Statistical detection of intruders within computer networks using scan statistics [M ] . London : Imperial College PressPress , 2014 : 71 - 104 .
钱叶魁 , 陈鸣 , 叶立新 , 等 . 基于多尺度主成分分析的全网络异常检测方法 [J ] . 软件学报 , 2012 ( 2 ): 361 - 377 .
QIAN Y Q , CHEN M , YE L X , et al . Network-wide anomaly detection method based on multiscale principal component analysis [J ] . Journal of Software , 2012 ( 2 ): 361 - 377 .
MCHUGH J . Testing intrusion detection systems:a critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by lincoln laboratory [J ] . ACM Transactions on Information and System Security , 2000 , 3 ( 4 ): 262 - 294 .
KENT A D . Cyber security data sources for dynamic network research [M ] . World Scientific Publishing . 2016 : 37 - 65
CSUBÁK D , SZÜCS K , VÖRÖS P , et al . big data testbed for network attack detection [J ] . Acta Polytechnica Hungarica , 2016 , 13 ( 2 ): 47 - 57
0
浏览量
2234
下载量
0
CSCD
- 网络PDF下载
- XML下载
- Meta-XML下载
- BibTeX下载
- Endnote下载
- RefMan 下载
- NoteExpress下载
- NoteFirst下载
关联资源
相关文章
相关作者
相关机构
AI问答- 技术支持由北京北大方正电子有限公司提供 京ICP备09064830号-19
京公网安备11010802024621 - 本系统建议在Chrome、 IE9+ 以上版本浏览器阅读本站内容，360浏览器请切换至极速模式
- Cookies帮助我们提供服务并提供个性化体验。使用本网站，即表示您同意我们使用Cookies
- 总访问量：582703 今日访问量：519