基于子图的服务器网络行为建模及异常检测方法研究

doi:10.3969/j.issn.1671-1122.2018.02.001

信息网络安全 ›› 2018, Vol. 18 ›› Issue (2): 1-9.doi: 10.3969/j.issn.1671-1122.2018.02.001

• • 下一篇

基于子图的服务器网络行为建模及异常检测方法研究

李巍^1,²(), 狄晓晓^1,², 王迪^1,², 李云春^1,³

1.北京航空航天大学计算机学院,北京100191
2.北京航空航天大学网络技术北京市重点实验室,北京100191
3.北京航空航天大学中德联合软件研究所,北京100191

收稿日期:2017-11-30 出版日期:2018-02-20 发布日期:2020-05-11
作者简介:
作者简介：李巍（1970—）,女,北京,副教授,博士,主要研究方向为网络安全、网络测量和性能分析、分布式应用测量及性能分析;狄晓晓（1993—）,女,山东,硕士研究生,主要研究方向为网络安全;王迪（1993—）,男,湖北,硕士研究生,主要研究方向为网络安全、分布式应用测量及性能分析;李云春（1972—）,男,北京,研究员,博士,主要研究方向为并行计算、计算机网络、网络安全、教育信息化。
基金资助:
国家自然科学基金[U1636208]

Subgraph-based Network Behavior Models and Anomaly Detection for Server

Wei LI^1,²(), Xiaoxiao DI^1,², Di WANG^1,², Yunchun LI^1,³

1. School of Computer Science and Engineering, Beihang University, Beijing 100191, China
2.Key Lab of Beijing Network Technology, Beihang University, Beijing 100191, China
3.Sino-German Joint Software Institute, Beihang University, Beijing 100191, China

Received:2017-11-30 Online:2018-02-20 Published:2020-05-11

摘要/Abstract

摘要：

随着恶意代码变异速度加快,隐蔽性越来越强,特别是在攻击者将流量特征进行混淆时,基于流量统计特征的网络异常检测方法漏报率变大。文章应用图分析方法,提出一种基于子图的服务器网络行为建模方法,该建模方法将本地主机流量按照本地主机、本地端口、远程端口、远程主机的顺序建立具有4层树形结构的有向图模型。该模型反映了本地主机与远程主机的通信关系以及两端进程间的通信关系。基于此模型,分别对服务器的客户端行为和服务端行为建立子图模型。由于服务端行为在子图结构上具有长期稳定性,文章提出了基于子图的服务器网络行为异常检测算法SNBAD。该算法对服务器的网络流量划分数据窗口,并对每个窗口分别建立服务子图模型,刻画每个子图的通信特征。该算法通过计算连续数据窗口服务子图的Jaccard相似系数来对异常行为进行检测。文章将主机感染恶意代码的流量混入真实网络流量数据中对SNBAD算法进行了验证,实验结果表明,SNBAD算法能够有效检测服务器服务端行为的异常。

关键词: 子图模型, 网络行为, 异常检测

Abstract:

With the accelerating variation of malicious code and its concealment from strength to strength, the network anomaly detection approach based on traffic features has higher false negatives, especially when the attacker confuses the traffic characteristics. In this paper, we propose a modeling method which establishes the directed graph model of a 4-layer tree structure in the order of local hosts, local ports, remote ports and remote hosts. This model reflects the relationships of end-hosts and the relationships among the processes in end-hosts. Based on this model, a subgraph model is established for the server's client behavior and server-side behavior respectively. Due to the long-term stability of server-side behavior in subgraph structure, this paper proposes a subgraph-based server network behavior anomaly detection algorithm SNBAD. The algorithm divides the server's network traffic into several data-windows and establishes the service subgraph models for each window respectively, and characterizes the communication features of each subgraph. The algorithm detects abnormal behavior by calculating the Jaccard similarity coefficient of the continuous data window. In this paper, the flow of host infected malicious code is mixed into the real network traffic data, and the SNBAD algorithm is verified. The experimental results show that the SNBAD algorithm can detect the abnormal of the server-side behavior of server effectively.

Key words: subgraph model, network behavior, anomaly detection

中图分类号:

TP309

李巍, 狄晓晓, 王迪, 李云春. 基于子图的服务器网络行为建模及异常检测方法研究[J]. 信息网络安全, 2018, 18(2): 1-9.

Wei LI, Xiaoxiao DI, Di WANG, Yunchun LI. Subgraph-based Network Behavior Models and Anomaly Detection for Server[J]. Netinfo Security, 2018, 18(2): 1-9.

图/表 9

图1

图2

图3

表1

图4

图5

图6

图7

图8

参考文献 23

[1]	李巍,李丽辉,李佳,等. 远控型木马通信三阶段流量行为特征分析[J].信息网络安全,2015(5):10-15.
[2]	BHUYAN M H, BHATTACHARYYA D K, KALITA J K.A Multi-step Outlier-based Anomaly Detection Approach to Network-wide Traffic[J]. Information Sciences, 2016, 348:243-271.
[3]	LEVCHUK G. Function and Activity Classification in Network Traffic Data: Existing Methods, Their Weaknesses,a Path forward[EB/OL].,2017-11-12.
[4]	KARAGIANNIS T, PAPAGIANNAKI K, FALOUTSOS M. BLINC: Multilevel Traffic Classification in the Dark[EB/OL]. ,2017-11-10.
[5]	LEVCHUK G, Colonna-Romano J, ESLAMI M. Application of Graph-based Semi-supervised Learning for Development of Cyber COP and Network Intrusion Detection[EB/OL].,2017-10-30.
[6]	HIMURA Y, FUKUDA K, CHO K, et al.Synoptic Graphlet: Bridging the Gap between Supervised and Unsupervised Profiling of Host-level Network Traffic[J]. IEEE/ACM Transactions on Networking (TON), 2013, 21(4): 1284-1297.
[7]	ASAI H, FUKUDA K, ESAKI H. Traffic Causality Graphs: Profiling Network Applications through Temporal and Spatial Causality of Flows[EB/OL]. , 2017-10-25.
[8]	CHENG G, TANG Y.PortView: Identifying Port Roles Based on Port Fuzzy Macroscopic Behavior[J]. Journal of Internet Services and Applications, 2013, 4(9): 2-12.
[9]	JIN Y, SHARAFUDDIN E, ZHANG Z L.Unveiling Core Network-wide Communication Patterns through Application Traffic Activity Graph Decomposition[J]. ACM SIGMETRICS Performance Evaluation Review, 2009, 37(1): 49-60.
[10]	ILIOFOTOU M, KIM H, FALOUTSOS M, et al.Graption: A Graph-based P2P Traffic Classification Framework for the Internet Backbone[J]. Computer Networks, 2011, 55(8): 1909-1920.
[11]	LATAPY M, VIARD T, MAGNIEN C. Stream Graphs and Link Streams for the Modeling of Interactions over Time[EB/OL]. .
[12]	FRANÇOIS J, WANG S, ENGEL T. BotTrack: Tracking Botnets Using NetFlow and PageRank[EB/OL]. .
[13]	VENKATESH B, CHOUDHURY S H, NAGARAJA S, et al.BotSpot: Fast Graph Based Identification of Structured P2P Bots[J]. Journal of Computer Virology and Hacking Techniques, 2015, 11(4): 247-261.
[14]	JUSZCZYSZYN K, KAZIENKO P, MUSIAL K, et al.Temporal Changes in Connection Patterns of an Email-based Social Network[C]// IEEE Computer Society. Proceedings of the 2008 IEEE/WIC/ACM International Conference on Web Intelligence and Intelligent Agent Technology, December 9-12, 2008, Washington, DC, USA. New York:IEEE, 2008: 9-12.
[15]	JUSZCZYSZYN K, KAZIENKO P, MUSIAŁ K. Local Topology of Social Network Based on Motif Analysis[EB/OL]. ,2017-11-23.
[16]	JUSZCZYSZYN K, KOŁACZEK G. Motif-based Attack Detection in Network Communication Graphs[EB/OL]. ,2017-11-29.
[17]	HARSHAW C R, BRIDGES R A, IANNACONE M D, et al.Graphprints: towards a Graph Analytic Method for Network Anomaly Detection[C]// ACM. Proceedings of the 11th Annual Cyber and Information Security Research Conference, April 5-7, 2016, New York, NY, USA. New York:ACM, 2016: 15.
[18]	PRZULJ N, CORNEIL D G, JURISICA I.Modeling Interactome: Scale-free or Geometric?[J]. Bioinformatics, 2004, 20(18):3508-3515.
[19]	杨连群,温晋英,刘树发,等. 一种改进的图分割算法在用户行为异常检测中的应用[J].信息网络安全,2016(6):35-40.
[20]	周颖杰. 基于行为分析的通信网络流量异常检测与关联分析[D].成都:电子科技大学,2013.
[21]	安冉,朱小波,严寒冰.一种基于时间序列分解的数据窃密事件检测方法研究[J].信息网络安全,2017(8):76-82.
[22]	CLEVELAND R B, CLEVELAND W S, TERPENNING I.STL: A Seasonal-trend Decomposition Procedure Based on Loess[J]. Journal of Official Statistics, 1990, 6(1): 3-33.
[23]	VALLIS O, HOCHENBAUM J, KEJARIWAL A.A Novel Technique for Long-term Anomaly Detection in the Cloud[C]// The Advanced Computing Systems Association. Proceedings of the 6th USENIX Workshop on Hot Topics in Cloud Computing (HotCloud 14), June17-18, 2014, Philadelphia, PA, United States. Berkeley, CA : USENIX, 2014: 1-6.

基于子图的服务器网络行为建模及异常检测方法研究

Subgraph-based Network Behavior Models and Anomaly Detection for Server

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 23

相关文章 15

编辑推荐

Metrics

本文评价

[1]	张浩, 谢大智, 胡云晟, 叶骏威. 基于半监督学习的网络异常检测研究综述[J]. 信息网络安全, 2024, 24(4): 491-508.
[2]	王健, 陈琳, 王凯崙, 刘吉强. 基于时空图神经网络的应用层DDoS攻击检测方法[J]. 信息网络安全, 2024, 24(4): 509-519.
[3]	江荣, 刘海天, 刘聪. 基于集成学习的无监督网络入侵检测方法[J]. 信息网络安全, 2024, 24(3): 411-426.
[4]	宋玉涵, 祝跃飞, 魏福山. 一种基于AdaBoost模型的区块链异常交易检测方案[J]. 信息网络安全, 2024, 24(1): 24-35.
[5]	秦中元, 马楠, 余亚聪, 陈立全. 基于双重图神经网络和自编码器的网络异常检测[J]. 信息网络安全, 2023, 23(9): 1-11.
[6]	蒋英肇, 陈雷, 闫巧. 基于双通道特征融合的分布式拒绝服务攻击检测算法[J]. 信息网络安全, 2023, 23(7): 86-97.
[7]	施园, 李杨, 詹孟奇. 一种面向微服务的多维度根因定位算法[J]. 信息网络安全, 2023, 23(3): 73-83.
[8]	吴圣麟, 刘汪根, 严明, 吴杰. 基于无监督系统调用规则生成的容器云实时异常检测系统[J]. 信息网络安全, 2023, 23(12): 91-102.
[9]	廖丽云, 张伯雷, 吴礼发. 基于代价敏感学习的物联网异常检测模型[J]. 信息网络安全, 2023, 23(11): 94-103.
[10]	张玉臣, 李亮辉, 马辰阳, 周洪伟. 一种融合变量的日志异常检测方法[J]. 信息网络安全, 2023, 23(10): 16-20.
[11]	顾兆军, 刘婷婷, 高冰, 隋翯. 基于GAN-Cross的工控系统类不平衡数据异常检测[J]. 信息网络安全, 2022, 22(8): 81-89.
[12]	周婧怡, 李红娇. 针对PMU测量的虚假数据注入攻击检测方法[J]. 信息网络安全, 2022, 22(5): 75-83.
[13]	陈彬杰, 魏福山, 顾纯祥. 基于KNN的具有隐私保护功能的区块链异常交易检测[J]. 信息网络安全, 2022, 22(3): 78-84.
[14]	徐茹枝, 吕畅冉, 龙燕, 刘远彬. 工业控制系统高隐蔽性数据攻击防御方法研究[J]. 信息网络安全, 2022, 22(12): 34-46.
[15]	郭森森, 王同力, 慕德俊. 基于生成对抗网络与自编码器的网络流量异常检测模型[J]. 信息网络安全, 2022, 22(12): 7-15.