基于异构系统的统一网络安全监控体系模型  

Hybrid-System Based Integrated Network Security Supervision System Model

作　　者：刘兰[1] 李之棠[1] 李家春[2] 梅成刚[2] 

机构地区：[1]华中科技大学计算机学院 [2]华南理工大学计算机科学与工程学院,广东广州510641

出　　处：《小型微型计算机系统》2006年第9期1682-1686,共5页Journal of Chinese Computer Systems

基　　金：国家网络与信息安全保障持续发展计划(2004研1-917-021)资助;国家重点基础研究发展计划"九七三"项目(2003CB314805)资助

摘　　要：针对大规模异构网络环境下安全行为的复杂性,现有的网络技术与管理缺少对海量原始数据的良好安全监控手段,本文提出构建统一的网络安全监控体系的思想,对各种异构数据源数据(审计日志和流量数据)进行标准化表示和整合,采用数据挖掘和小波分析的方法对数据进行分析处理,通过关联规则、流量规则和规则序列模式分析出整个网络的运行情况,对系统分析结果给出可视化结论,调整安全策略以适应网络安全动态性和整体性.In view of the complexity of network behavior among the hybrid systems, the technology and management of existing network systems are lack of enough effective security supervision measures for the great capability of the raw data. This paper developed a system model to supervise the security of network system, by normalizing and integrating the raw data from hybrid data-sources （including Syslog and traffic etc. ）, then using data-mining and wavelet technology to analyze the integrated information. At last this system used correlation rules, traffic rules and rule sequential pattern to analyze and drew out a visual conclusion of the network system security status which helps to adjust policy to enhance the system security.

关 键 词：网络行为学 关联 数据挖掘 小波分析 监测 

分 类 号：TP293[自动化与计算机技术—检测技术与自动化装置]