一种基于数据流的网络威胁监控框架  

A Global Stream-Based Network Threat Monitoring System

作　　者：缪嘉嘉[1] 张瞩熹 贾焰[1] 吴泉源[1] 

机构地区：[1]国防科技大学计算机学院,湖南长沙410073 [2]总后后勤科学研究所,北京100071

出　　处：《计算机工程与科学》2009年第12期23-26,51,共5页Computer Engineering & Science

摘　　要：本文基于数据集成和数据流技术,提出一种网络威胁监控框架。该框架复用底层IDS、Fire Wall、Net Flow等系统的监控日志,将安全日志转换为该系统的数据流输入,通过模式映射屏蔽各异构系统的日志异构,使得用户能够在全局视图上进行网络事件查询。该框架的优势在于:(1)复用已有安全日志,避免重复部署网络探测器;(2)使得各分布式系统之间的监测结果能够共享;(3)基于数据流的查询技术能够保障监控的及时性和连续性;(4)通过实验验证了系统良好的扩展性和适应性。Computer networks have become a ubiquitous and integral part of the nation＇s critical infrastructure. In this paper,we propose a novel solution called GS-TMS （Global Stream-based Threat Monitoring System） which reuses the log data generated by the existing widely-spread security systems. Based on the data stream and data integration technologies, GS-TMS provides a desirable capability in quickly building a large-scale distributed network monitoring system. Furthermore, GS-TMS has additional notable advantages over the current monitoring systems in scalability and flexibility.

关 键 词：数据流 数据集成 网络监控 入侵检测 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]