基于频繁模式挖掘的Internet骨干网攻击发现方法研究  

An Adaptive lnternet Backbone Traffic Anomalies Detection Algorithm Based on Frequent Pattern Mining

作　　者：顾荣杰[1] 晏蒲柳[1] 邹涛[2] 杨剑峰[1] 

机构地区：[1]武汉大学电子信息学院通信工程系,武汉430072 [2]北京系统工程研究院,北京100101

出　　处：《计算机科学》2006年第9期76-80,共5页Computer Science

基　　金：国家自然科学基金项目(90204008)。

摘　　要：DDOS、蠕虫和病毒邮件已经成为影响骨干网络安全的3大主要因素,近几年来不断爆发的安全事件已经造成了巨额的经济损失。这些攻击具有贪婪性以及模式频繁重复的特点。本文时这3种方式分别进行了建模,提出了一种新的基于攻击行为模式分析的TIR模型,并提供了相应的快速挖掘算法。基于本文的方法在应用中能以较低的资源代价检测到未知的攻击并定位受害源。为提高算法的效率,本文提出了基于双页表结构的TIR攻击树构建方法,实验证明它能有效地提升信息采集速度。DDOS, worm and mass mailing have a significant growth recent years, which has endangered Internet security. Most attack like worm has the nature of aggressive, greedy and behavior pattern of self-similar. This paper proposed an attack behavior analysis based model, TIR model and devised a fast algorithm based on frequent pattern mining. It can effectively detect known or unknown threats with a low cost and has the ability to report the suspicious address. This paper also puts forward an effective algorithm to improve the real-time detection performance, namely 2- page hash table algorithm. As a result we developed a distributed system namely M-Detector based our theories.

关 键 词：大规模网络威胁 频繁模式检测 双页表HASH结构算法 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]