网络流的层次化分析及其在蠕虫早期检测中的应用

蔡忠闽 1; 2; 秦涛 1; 2

您当前的位置：

首页 >

文章列表页 >

网络流的层次化分析及其在蠕虫早期检测中的应用

专题研究 | 更新时间：2025-12-08

- 网络流的层次化分析及其在蠕虫早期检测中的应用
- Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms
- 西安交通大学学报 2007年41卷第4期页码：393-397
- 作者机构：
  
  1. 西安交通大学智能网络与网络安全教育部重点实验室,西安,710049
  2. 西安交通大学机械制造系统工程国家重点实验室,西安,710049
- 作者简介：
- 基金信息：
  
  : 2006-07-31. 作者简介: 蔡忠闽(1976～),男,博士,讲师. 基金项目: 国家高技术研究发展计划资助项目(2001AA142060);国家自然科学基金资助项目(60243001)
- DOI：
  中图分类号： TP393
- 网络首发：2007-04-10，
  
  纸质出版：2007
- 稿件说明：
移动端阅览
蔡忠闽 1, 2, 秦涛 1, 等. 网络流的层次化分析及其在蠕虫早期检测中的应用[J]. 西安交通大学学报, 2007,41(4):393-397.

蔡忠闽 1, 2, 秦涛 1, et al. Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms[J]. 2007, 41(4): 393-397.
蔡忠闽 1, 2, 秦涛 1, 等. 网络流的层次化分析及其在蠕虫早期检测中的应用[J]. 西安交通大学学报, 2007,41(4):393-397. DOI：

蔡忠闽 1, 2, 秦涛 1, et al. Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms[J]. 2007, 41(4): 393-397. DOI：

摘要

在NetFlow的基础上定义了2种新的网络流:主机层网络流和区域层网络流

并提出了相应的流量特征刻画方法.该定义从主机层和网络层对网络流量进行抽象

实现了底层网络流信息的合并

在不损失关键流量特征的前提下

可大大缩减网络流记录的数量.采用指数加权移动平均控制图模型对所提取的网络流特征进行预测和估计

并结合网络蠕虫的传播特征给出了一种网络蠕虫的早期检测方法.实验结果表明

所提检测方法可以准确地检测到蠕虫在局域网内的早期传播

进而为控制蠕虫传播赢得了宝贵的时间.

Abstract

Based on NetFlow

the definition of two net-flows

Host-Net-Flow and Region-Net-Flow

as well as a depictive method for corresponding network traffic characteristics are proposed. The netflows are abstracted from the host level and network level by the definition. The incorporation of netflow information in bottom level is implemented

and the number of netflow records can significantly be reduced without losing key network traffic characteristics. EWMA(exponential weighted moving average)control chart models are employed to forecast and estimate the distilled network traffic features

then an early net-worm propagation detection method is presented considering the features of network worm propagation. The experimental results show that the early worm propagation in local networks can be detected both quickly and accurately by the proposed method

thereby worm propagation can be controlled as soon as possible.

关键词

Keywords

references

Staniford S, Paxson V, Weaver N. How to own the Internet in your spare time[C]∥Proceedings of the 11th USENIX Security Symposium. Berkeley, USA:USENIX Assoc., 2002:149-167.

Cisco systems Inc. CISCO NetFlow [EB/OL]. [2006-02-11].http:∥www.cisco.com/en/US/products/ps6601/products_ white_ paper09186a00800a3db9. shtml.

Laffy K C, Braun H W, Olyzos G C. A parameterizable methodology for Internet traffic flow profiling [J]. IEEE Journal of Selected Areas in Communications, 1995, 13(8):1481-1494.

Lakhina A, Crovella M, Diot C.Characterization of network-wide anomalies in traffic flows, BUCS-2004-020 [R]. Boston:Boston University, 2004.

Buchholz F, Daniels T E, Early J P, et al. Digging for worms, fishing for answers [C]∥Proceedings of Computer Security Applications Conference. Los Alamitos, USA: IEEE Computer Society, 2002:219-226.

Box G, Lceno A. Statistical control by monitoring and feedback adjustment [M]. New York: John Wiley Sons, 1999:158-263.

Moore D, Keys K, Koga R, et al. The CoralReef software suite as a tool for system and network administrators [EB/OL]. [2005-01-21]. http:∥www. caida. org/tools/measurement/coralreef.

Leland W, Taqqu M, Willinger W, et al. On the self-similar nature of Ethernet traffic(extended version)[J]. IEEE/ACM Transactions on Networking, 1994, 2(1):1-15.

Fiorini P M. On modeling concurrent heavy-tailed network traffic sources and its impact upon QoS [C]∥1999 IEEE International Conference on Communications. Piscataway,USA:IEEE, 1999:716-720.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

域名请求行为特征与构成特征相结合的域名变换检测

应用三角模糊矩阵博弈的网络安全评估研究

面向拒绝服务攻击的多标签IP返回追踪新方法

电子级超纯氮深冷空分流程节能优化研究

EBSILON软件在热电联产系统优化中的应用综述