文档介绍：摘 要
随着网络技术的蓬勃发展, 在人们的日常生活中发挥着越来越重要的作用。电子商务、网上银行等大量网络应用服务的出现和普及给人们的日常生活带来了极大的便利,但同时也为不法分子的牟利提供了一个广阔的平台。近年来通过网络实施的犯罪日益上升,所带来的经济损失也日益增大,给整个社会的和谐发展造成极大的不良影响,网络安全已成为一个至关重要且亟待解决的问题。论文在分析了当前网络安全面临的紧迫性的基础上,探讨了网络威胁的原理和种类以及网络安全防护技术的发展情况,强调了网络流量分析在解决网络安全问题上的重要作用,分析和研究了当前几种比较典型的网络流量分类算法的原理及局限性,设计并实现了一种基于行为的流量分类方法,能够较好地对主机对外流量进行分类并清楚明确地显示主机网络状态从而识别和遏制可疑行为。探讨和分析了主机的网络行为研究的重要意义和主要方法,研究和设计了流量特征数据为基础的知识库的构建、数据组织等方面的内容,能够较好地检测和识别常规网络行为;在研究和分析了入侵检测技术的相关思想上,设计和实现了一种基于流量特征的恶意网络行为的检测技术,并对该技术的原理、实现方法和性能做了深入地研究和分析,实验显示,该技术能够比较好的检测和识别文件盗取型恶意网
络行为。
从主机行为监管和数据保护的实现目标出发,以网络流量分析为基础设计并实现了 NSP-TB 主机安全防护系统,对该系统的实现目标、总体结构、主要功能、模块设计和实现技术进行了详细的阐述,并在各种实验条件下对该系统所具有的性能进行了测试和分析,最后针对系统所存在的缺陷和不足提出了下一步主要的工作和研究内容。
关键词:网络安全,数据保护,网络行为,流量分类,恶意行为检测
ABSTRACT
With the rapid development work technology, the is playing an increasingly role in people’s daily life. The emergence of a large number work applications and services such as merce, online banking services have brought great convenience to people's daily life,but also provided a broad platform for the profit-making of the lawless elements. In recent years, the work crimes brought large economic losses and caused great negative impact to the harmonious development of society as a whole. Network security has e a critical and urgent problem.
The contributions of this thesis are summarized as follows. Based on analyzing the security threats work is facing, we review the principles, categories and ongoing developments work defense technology, and highlight the import role work traffic analysis in work. Based on parative study of several work traffic classification algorithms, we design and implement a novel behavior-based classification approach, which characterizes work state of a host by accurately classifying its outbound traffic, in order to recognize and prevent suspicious behaviors. Furthermore, we study the details involved in the construction of knowledge base and anization based on traffic characteristics. Finally, on the basis of current intrusio