基于数据包分析的网络攻击诊断研究  

The Study on Network Attacks Diagnosis Based on Data Packets Analysis

作　　者：马之力[1] 智勇[1] 张驯[1] 闫晓斌[2] 党倩[3] 袁晖[1] 朱小琴[1] 

机构地区：[1]国网甘肃省电力公司电力科学研究院,甘肃兰州730050 [2]国网甘肃省电力公司科技信通部,甘肃兰州730050 [3]国网甘肃省电力公司信息通信公司,甘肃兰州730050

出　　处：《网络空间安全》2016年第7期54-57,共4页Cyberspace Security

摘　　要：近年来,网络攻击手段愈加丰富、隐蔽性更强,入侵检测、态势感知等安全防护技术虽能发挥重要作用,但针对有些攻击方式则难以监测其攻击行为,在排查诊断攻击时也收效有限。论文研究提出通过捕获数据包并对其进行分析,将网络从原来封闭的黑盒子,变为可直观展现的详细数据,进而诊断定位网络攻击的方法,并列举了相应的实例。该方法能够快速诊断定位网络攻击源及攻击手段,并且解决常规分析手段难以分析的疑难攻击问题。Recent years, the means of network attacks are increasingly rich, and more concealed. Meanwhile, Intrusion detection,situational awareness and other security technology can play an important role, but for some attacks it is difficult to monitor its aggressive behavior, and is also limited success when troubleshooting diagnosis attack. The paper proposes a method for the diagnosis of attacks targeting network by capturing and analyzing data packets. So, the detailed data of network can be visually show. Additionally, the paper lists the corresponding instance. This method can quickly diagnose and locate the source and means of network attacks,and solve difficult problems of the conventional methods difficult to analyze.

关 键 词：数据包分析 数据包捕获 网络攻击 攻击诊断 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]