CAJ | 학술논문

近年来国内外发生多起大规模网络攻击和泄露事件,同时零日攻击、高级持续威胁(APT)等攻击方式的出现和日益普遍,促使基于全面多阶段的网络杀伤链的网络安全防护架构产生并迅速被众多厂商采用和推广,该架构中对主机网络异常行为的分析成为对恶意软件的大量变种入侵后及时检测的关键技术.以往的异常行为分析模型算法单一,缺乏对间接维度、时序关联的考虑.文章提出一种自适应网络异常的数据分析模型,可分析具有单一特性和分布特性的网络维度,并考虑了时间和时域多周期对网络维度的影响.应用该模型的产品易于管理,异常和攻击行为识别准确,可较好地提升网络杀伤链的分析准确性.
근년래국내외발생다기대규모망락공격화설로사건,동시령일공격、고급지속위협(APT)등공격방식적출현화일익보편,촉사기우전면다계단적망락살상련적망락안전방호가구산생병신속피음다엄상채용화추엄,해가구중대주궤망락이상행위적분석성위대악의연건적대량변충입침후급시검측적관건기술.이왕적이상행위분석모형산법단일,결핍대간접유도、시서관련적고필.문장제출일충자괄응망락이상적수거분석모형,가분석구유단일특성화분포특성적망락유도,병고필료시간화시역다주기대망락유도적영향.응용해모형적산품역우관리,이상화공격행위식별준학,가교호지제승망락살상련적분석준학성.
Recently, due to the occurrence of a series of large scale of attack and data leaking affections, and the common of zero-day and APT attacks, the networking security architecture using cyber kill chain based on multi-stages emerges and is widely used in industry. The network abnormal behavior analysis is the key technology to detect the mass variants of malwares that intrude in the architecture. Most of existing abnormal behavior analysis models uses the simple algorithm without considering temporal association, indirect dimension, etc. This paper proposes an adaptive networking abnormal analysis model which applies into single and distribution dimensions, and considers time and periodic affections. This model has better usability and more accurate abnormal detection results, and can help a lot on overall analysis results by using cyber kill chain.