一种面向网络行为因果关联的攻击检测方法  

Approach for Detecting Attack Based on Causality of Network Behavior

作　　者：王志文[1] 夏秦[1] 李平均[1] 

机构地区：[1]西安交通大学计算机科学与技术系,西安710049

出　　处：《西安交通大学学报》2008年第6期707-707,共1页Journal of Xi'an Jiaotong University

基　　金：国家自然科学基金资助项目(60633020,60473136,60373105);; 国家高技术研究发展计划资助项目(2006BAH02A24-2,2006BAK11B02,2007AA01Z475);; 国家“二四二”信息安全计划资助项目(2006C26)

摘　　要：为了能在攻击目标受损之前检测到攻击事件，提出了一种面向网络行为因果关联的攻击检测方法．基于SNMPMIB数据，根据攻击目标的异常行为，利用GCT从检测变量中挖掘出与异常变量存在整体行为关联的基本攻击变量，然后针对异常行为特征，再次利用GCT从基本攻击变量中挖掘出与异常变量存在局部行为关联的攻击变量，最后根据攻击变量和异常变量之间的因果关系，构建面向攻击方检测的攻击关联规则．在Trin00 UDP Flood检测实验中，所提方法在挖掘出攻击变量udp Out Datagrams上取得了满意的检测效果．An SNMP MIB oriented approach based on causality in network behavior is presented in order to detect attack before the security of target is damaged.According to the behavior of an abnormal variable in target,Granger causality test(GCT) is used to find preliminary attacking variables which are causality relevant to the abnormal variable in whole network behavior.Depending on the behavior features hidden in the abnormal behavior,GCT is used again to recognize attacking variables which are causality relevant to the abnormal variable in local network behavior.The causality between attacking variables and the abnormal variable is then used to construct detecting rules,which are oriented to attacker.udpOutDatagrams acting as attacking variable are recognized successfully and detection results are acquired well in the test of Trin00 UDP Flood.The experiment results show that the approach can effectively detect attacks from attackers,which has effect on blocking the pervasion of attacking procedure to target.

关 键 词：网络行为 攻击目标 GCT检测 检测方法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术] TJ76[自动化与计算机技术—计算机科学与技术]