一种分布式恶意流量检测系统设计与实现  

Design and Implementation of a Distributed Malicious Traffic Detection System

作　　者：郭乔进[1] 张志华 张欣怡 产院东 Guo Qiaojin;Zhang Zhihua;Zhang Xinyi;Chan Yuandong(The 28th Research Institute of China Electronics Technology Corporation,Nanjing 210007,China)

机构地区：[1]中国电子科技集团公司第28研究所,南京210007

出　　处：《信息化研究》2022年第2期60-64,共5页INFORMATIZATION RESEARCH

摘　　要：现代军事网络拓扑复杂,恶意流量告警数量呈爆炸性增长,一级分析师作为最直接的告警数据处理人员,完全淹没在告警数据的海洋中,很难发现真正有威胁的告警。本技术通过研究基于上下文的综合研判模型,利用大数据流处理技术,对海量告警流量数据进行时域、空域综合研判,关联和挖掘威胁时间,有效过滤无用告警数据,提升分析师的工作效率,为更快处理威胁事件提供技术支撑。The topology of modern military networks is complex,and the number of malicious traffic alarms is increasing explosively.As the most direct alarm data processing personnel,first-level analysts are completely submerged in the ocean of alarm data,and it is difficult to find real threatening alarms.The context-based comprehensive judgment model uses big data stream processing technology to conduct time-domain and air-space comprehensive judgment on massive alarm traffic data,correlate and mine threat time,effectively filter useless alarm data,improve analyst work efficiency,to deal with threats faster and provide technical support.

关 键 词：上下文 流处理 网络攻击 流量分析 

分 类 号：TP301.4[自动化与计算机技术—计算机系统结构]