网络安全事件关联规则自动生成技术的研究与实现

第 ii 页பைடு நூலகம்
国防科学技术大学研究生院硕士学位论文
表
表 2.1 表 2.2 表 3.1 表 4.1 表 5.1 表 5.2 表 5.3 表 5.4 表 5.5 表 5.6 表 5.7 表 5.8 表 5.9
目
录
规则属性描述 .................................................................................................... 6 关联指令属性描述 ............................................................................................ 7 实验节点信息 .................................................................................................. 26 攻击测试结果 .................................................................................................. 39 二元形式的购物篮数据 .................................................................................. 41 网络安全事件表 .............................................................................................. 41 序列数据表示例 .............................................................................................. 43 原始数据表 ...................................................................................................... 45 排序后的表 ...................................................................................................... 46 频繁 1-序列编码表 .......................................................................................... 46 源目 IP 编码表 ................................................................................................. 46 最终序列数据表 .............................................................................................. 47 序列数据库 ...................................................................................................... 48
第 i 页
国防科学技术大学研究生院硕士学位论文
ABSTRACT
Network Security Events Correlation Rule (saying Correlation Rule for short in the following) defines and descripts the relation among different events. It implies a successfully launched attack’s scenario. Correlation technology based on correlation rule is easy to perform and is effective to discover the relation among different network security events. This technology has been wide used in the current popular security products. The amount of correlation rules in these products is so less than that of the current attacks that correlation subsystem’s further application is constrained seriously. So it is valuable to research on correlation rule’s generation, which contributes much to correlation technology’s performance. This thesis mainly research on the technology of automatic generation of correlation rules. The contribution of this thesis includes: 1) Research and comparison have been performed in depth on the current method and technology of correlation rule’s generation. 2) A technology of correlation rule’s automatic generation based on attack traffic is proposed. With the integration of some open-source penetration tools, attack traffic can be automatically generated. It can generate correlation rules against known attacks automatically by gathering the security events which are triggered by the attack traffic. 3) We analyze and summarize the typical attack patterns based on scientific classification of network attacks, then propose an approach on automatic generation of correlation rule based on attack pattern. This approach decreases the difficulty of correlation rule’s generation against known attacks and complement the above approach. 4) Considering the feature of mass security events and appearance of unknown attacks in large-scale network, we develop a technology based on sequential pattern’s mining. This technology can discover the correlation rules related to complex attack pattern and unknown attacks without any knowledge provided. 5) A prototype system is developed for automatic generation of correlation rules. By combining the technologies above, each one’s disadvantage is complemented by others. Correlation rules of different kinds will be generated. Key Words: network security event, correlation rule, generation, automatic
国防科学技术大学 硕士学位论文 网络安全事件关联规则自动生成技术的研究与实现 姓名：李阳 申请学位级别：硕士 专业：计算机科学与技术 指导教师：徐锡山 2010-11
国防科学技术大学研究生院硕士学位论文
摘
要
网络安全事件关联规则 (下文简称关联规则 )是对网络安全事件之间关系的定 义和描述，它反映了攻击成功执行时的场景。基于关联规则的关联分析技术易于 实现且能有效的发现不同网络安全事件之间的关系，在当前主流的网络安全产品 中得到了广泛的应用。然而在这些产品中，关联规则的数量远远少于典型网络攻 击的数量，严重制约了关联分析系统的进一步应用。所以对关联规则的生成进行 研究具有非常重要的应用价值，它关系到基于规则的关联分析技术的实用程度。 本文重点研究关联规则的自动生成技术，主要工作有以下几个方面： 1) 2) 对现有的关联规则增加方法和自动生成技术进行了深入研究和比较，指出现 有技术的优缺点。 提出了基于攻击流量的关联规则自动生成技术，集成开源的渗透测试工具， 自动生成攻击流量，收集这些攻击流量所触发的安全事件，自动生成针对已 知攻击的关联规则。 3) 在对网络攻击进行科学分类的基础上，分析总结典型的攻击模式，提出了基 于攻击模式的关联规则自动生成技术，是对基于攻击流量的关联规则生成技 术的补充，进一步降低针对已知攻击的关联规则的生成难度。 4) 针对大规模网络会产生海量安全事件，且新的攻击不断出现的特点，提出了 基于序列模式挖掘的关联规则生成技术，无需任何攻击知识，发掘针对大规 模网络攻击和未知攻击的关联规则。 5) 设计并实现了一个关联规则自动生成系统，将上述三种技术结合起来，优势 互补，以便生成各种类别的关联规则。 主题词：网络安全事件，关联规则，自动，生成