【優(yōu)秀碩博論文】基于網(wǎng)絡(luò)通信行為異常的竊密apt攻擊檢測研究

1、碩士學(xué)位論文基于網(wǎng)絡(luò)通信行為異常的竊密APT攻擊檢測研究學(xué)位類別工學(xué)碩士工學(xué)碩士學(xué)科名稱控制理論與控制工程控制理論與控制工程研究方向網(wǎng)絡(luò)信息安全網(wǎng)絡(luò)信息安全論文提交時(shí)間2015.01摘要隨著計(jì)算機(jī)網(wǎng)絡(luò)技術(shù)的廣泛應(yīng)用，信息安全已成為網(wǎng)絡(luò)信息保障的核心關(guān)鍵問題。以高級滲透和傳播技術(shù)為手段，具有極強(qiáng)隱蔽性以及持久性特點(diǎn)的APT攻擊業(yè)已成為目前威脅網(wǎng)絡(luò)安全的最大隱患。針對APT攻擊的網(wǎng)絡(luò)防御也成為當(dāng)前網(wǎng)絡(luò)信息安全防護(hù)的熱點(diǎn)和難點(diǎn)問題之一。本文結(jié)

2、合竊密APT攻擊案例以及部分APT攻擊樣本數(shù)據(jù)包，對APT攻擊實(shí)施的各階段所存在的通信行為進(jìn)行了分析，并據(jù)此提出了一種基于節(jié)點(diǎn)通信行為異常指數(shù)的竊密APT檢測方法，并搭建了仿真實(shí)驗(yàn)平臺對所提的方法進(jìn)行了驗(yàn)證。論文開展的主要研究工作如下：(1)通過對典型APT攻擊的深入分析，系統(tǒng)性地將竊密APT攻擊劃分為五個(gè)階段，即信息收集期，惡意程序感染初期，潛伏I期，潛伏II期和撤離期。并結(jié)合已知的APT攻擊案例和APT通信數(shù)據(jù)包樣本，對各個(gè)階段AP

3、T的異常通信行為特點(diǎn)進(jìn)行詳細(xì)地分析。(2)設(shè)計(jì)了包括數(shù)據(jù)包基本信息提取、連接和會(huì)話分析、網(wǎng)絡(luò)通信行為特征提取、節(jié)點(diǎn)感染風(fēng)險(xiǎn)分析以及檢測結(jié)果告警五個(gè)模塊組成的竊密APT檢測系統(tǒng)。對網(wǎng)絡(luò)數(shù)據(jù)包的處理和感興趣信息的提取方法進(jìn)行介紹，針對內(nèi)網(wǎng)和外網(wǎng)通信異常特點(diǎn)，構(gòu)建了共計(jì)13種異常通信行為特征，并分別給出了每種特征的統(tǒng)計(jì)和計(jì)算方法。(3)提出了一種基于節(jié)點(diǎn)通信行為異常指數(shù)的竊密APT檢測方法。該方法包括節(jié)點(diǎn)異常通信行為判定和內(nèi)網(wǎng)節(jié)點(diǎn)感染指數(shù)的計(jì)

4、算方法。其中，閾值的判定主要采用基于正常網(wǎng)絡(luò)通信數(shù)據(jù)的觀測數(shù)據(jù)通過引入一定的裕度來得到；權(quán)值的設(shè)定當(dāng)前主要依賴分析和經(jīng)驗(yàn)；感染指數(shù)的計(jì)算過程中引入了相鄰窗口的動(dòng)態(tài)閾值機(jī)制，用于消除單個(gè)窗口內(nèi)虛警的影響，且能在當(dāng)前窗口保留對歷史觀測風(fēng)險(xiǎn)的結(jié)果。AbstractWiththewideapplicationofcomputerwktechnologyinfmationsecurityhasbecomeakeyissueofwkinfmatio

5、nsecurity.UsingtheadvancedmannerstoperfmperationspreadingAPTattackwithstrongsteathypersistentfeatureshasbecomethebiggestthreatagainstwksecurity.ThusthewkdefenseagainstAPTattacksalsohasbecomeoneofthehotdifficultissuesincu

6、rrentwkinfmationsecurityfield.InthisdissertationThecommunicationbehavioursineachstageofAPTsecreteavespingattackareanalyzedaccdingtotheinvestigationofthepracticalcasesdatum.ThedetectionmethodagainstAPTsecreteavespingattac

7、kispropsoedbasedontheindexoftheabnmalcommunicationbehavioursofeachnodethesimulationtestingplatfmisbuilttoverfiytheeffectiveness.Themainresearchwkachievementsareasfollows.(1)ThroughdeeplyanalysisoftypicalAPTattackstheAPTs

8、ecreteavespingattackisdividedintofivestagesystematically.Theyare.infmationgatheringphasemalwareinfectionearlyphaselatentphaseIlatentphaseIIwithdrawalphase.AccdingtoAPTattackcasescommunicationpacketsamplestheabnmalcommuni

9、cationbehavioursineachstageareanalyzed.(2)TheAPTsecreteavespingattackdetectionsystemisdesignedincludingpacketinfmationextractingmoduleconnectionconversationanalyzingmodulewkcommunicationbehavioursfeatureextractingmodulen

10、odeinfectionriskanalyzingalarmingmodule.Thewkpacketsprocessinginterestinginfmationextractingmethodisgive.Total13kindsofabnmalcommunicationbehaviouracteristicsareconstrutedthestatisticscalculationmethodsaregiven.(3)Thedet

11、ectionmethodbasedontheindexofabnmalcommunicationbehavioursofnodesisproposedwhichincludesthenode’sabnmalcommunicationbehavioursjudgementtheintranodes’infectionindexcalculation.Thedecisionthresholdisdeterminedbasedonthenma

12、lwktrafficobservationafterintroducingsomemargin.Intheinjectionobjectindexcomputationtheweightsisobtainedmainlybasedonexperiences.dynamicthresholdmechanismisalsousedtoreservethehisticalobservationriskresultseliminatethein