基于可信密码模块的网络潜在攻击挖掘研究  

Research on Network Potential Attack Mining Based on Trusted Password Module

作　　者：匡凤飞 张德富[2] KUANG Feng-fei;ZHANG De-fu(Minnan Science and Technology Institute,Quanzhou Fujian 362332,China;Xiamen University,Xiamen Fujian 361005,China)

机构地区：[1]闽南科技学院,福建泉州362332 [2]厦门大学,福建厦门361005

出　　处：《计算机仿真》2021年第7期294-298,共5页Computer Simulation

基　　金：福建省级新工科研究与改革实践项目(SJXGK-2020-03);闽南科技学院重点教改项目(MKJG-2018-001)。

摘　　要：由于网络攻击具有潜在性,且数据相似度计算能力不佳,导致处理时间较长,设计基于可信密码模块的网络潜在攻击挖掘方法。构建可信密码模块管理器对vTCM实例展开管理,使用AP算法计算处理后的数据相似度进行计算,初步区分潜在威胁数据与正常数据。计算潜在威胁数据的吸引度与归属度,明确区分潜在攻击数据,基于可信密码模块完成网络潜在攻击挖掘。实验结果表明,警报日志的数量由原始的1000下降到350条,无效警告消除率高达75%,其警告的正确率也达到了95%以上,CPU占用率一直维持在一个水平线上,挖掘时间未出现波动,在日后的研究中可使用此方法作为网络安全管理中的主要技术。Due to the potential of network attack and poor ability of data similarity calculation, it takes a long processing time. Therefore, we reported a method of mining potential network attacks based on trusted cryptography module. The manager of trusted password module was set up to manage vTCM. AP algorithm was introduced to calculate the similarity of processed data. Potential threat data and normal data were distinguished to calculate the attraction and attribution of potential threat data, distinguishing potential attack data. Finally, network potential attack mining was completed based on trusted password module. The results show that the number of alarm logs decreases from 1000 to 350, the invalid warning elimination rate is as high as 75%, and the correct warning rate is more than 95%. The CPU utilization rate has been maintained at a level, and the mining time does not fluctuate, which indicates that this method can be used as the main technology in network security management.

关 键 词：可信密码模块 网络安全 相似度计算 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]