一种快速检测小包攻击的原理和实现  

Principle and implementation of a rapid detection method from mini network packets attacking

作　　者：谢锐[1] 赖学亮[1] 金耀辉[1] 

机构地区：[1]上海交通大学网络信息中心,上海200240

出　　处：《广西大学学报（自然科学版）》2011年第A01期131-136,共6页Journal of Guangxi University（Natural Science Edition）

基　　金：国家科技支撑计划(2008BAH37B05)

摘　　要：如何快速定位园区网络中发生的网络攻击行为,是解决此类安全事件的关键所在。文章从网络自相似原理出发,按照异常检测法的原则,通过读取网元中RMON信息,分析并判断网络中是否存在攻击行为,从而对网络流量自相似性在网络安全领域的应用做了有益的研究。The key point to solve network security incidents is how to quickly locate where network attacks exists in campus network. In this paper, according to the principle of the network traffic self- similarity and anomaly detection method, we were able to determine whether the network attacks exist by reading and analyzing the RMON information in network elements. This was the first attempt to apply the network traffic self-similarity into the field of network security.

关 键 词：网络攻击行为 自相似性 异常检测法 RMON SNMP 

分 类 号：TP316[自动化与计算机技术—计算机软件与理论]