论文部分内容阅读
准确高效地在骨干网流量中识别各种恶意流量一直都是网络安全领域的热点需求.分析设计了一种使用8种传输层会话特征的恶意流量检测及识别方法,并结合数据包固定特征检测实现了一个恶意流量实时识别引擎.系统选取的会话双向数据包长度分布、不同字节出现频率、字节数据重用值和时间间隔等会话行为特征通用性强、协议区分度高,能够很好地支持系统的扩展性.实验结果表明采用该引擎的恶意流量识别系统对具体会话协议的识别只需要处理对应会话的前20-30个数据包,在保证较高识别准确率的同时,较好地满足了实时性的要求.
Accurately and efficiently identifying various kinds of malicious traffic in backbone traffic has always been a hot demand in the field of network security.A malicious traffic detection and identification method using 8 kinds of transport layer session features is analyzed and designed. Combined with the fixed characteristics of packet inspection A real-time recognition engine for malicious traffic was implemented.The session bi-directional packet length distribution, the different byte occurrence frequency, the byte data reuse value and the time interval of the session selected by the system have strong universality and high agreement distinguishing ability, Support the scalability of the system.Experimental results show that using this engine’s malicious traffic identification system to identify the specific session protocol only need to deal with the first 20-30 packets corresponding to the session to ensure a high recognition accuracy at the same time, Meet the real-time requirements.