网络与信息安全学报 ›› 2021, Vol. 7 ›› Issue (5): 132-148.doi: 10.11959/j.issn.2096-109x.2021085

• 学术论文 • 上一篇    

基于规则关联的安全数据采集策略生成

陈佩1,2, 李凤华1,2, 李子孚1,2, 郭云川1,2, 成林3   

  1. 1 中国科学院信息工程研究所,北京 100093
    2 中国科学院大学网络空间安全学院,北京 100049
    3 中国信息安全测评中心,北京 100085
  • 修回日期:2021-02-01 出版日期:2021-10-01 发布日期:2021-10-01
  • 作者简介:陈佩(1993− ),男,河南南阳人,中国科学院信息工程研究所硕士生,主要研究方向为网络与系统安全
    李凤华(1966− ),男,湖北浠水人,博士,中国科学院信息工程研究所研究员、博士生导师,主要研究方向为网络与系统安全、信息保护、隐私计算
    李子孚(1992− ),女,内蒙古赤峰人,博士,中国科学院信息工程研究所工程师,主要研究方向为网络与系统安全、访问控制
    郭云川(1977− ),男,四川营山人,博士,中国科学院信息工程研究所正高级工程师、博士生导师,主要研究方向为访问控制、网络安全
    成林(1983− ),男,博士,中国信息安全测评中心助理研究员,主要研究方向为密码学、云计算、大数据
  • 基金资助:
    国家重点研发计划(2016QY06X1203);国家自然科学基金(U1836203);山东省重点研发计划(重大科技创新工程)项目(2019JZZY020127)

Using rule association to generate data collection policies

Pei CHEN1,2, Fenghua LI1,2, Zifu LI1,2, Yunchuan GUO1,2, Lin CHENG3   

  1. 1 Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
    2 School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China
    3 China Information Technology Security Evaluation Center, Beijing 100085, China
  • Revised:2021-02-01 Online:2021-10-01 Published:2021-10-01
  • Supported by:
    The National Key R&D Program of China(2016QY06X1203);The National Natural Science Foundation of China(U1836203);Shandong Provincial Key Research and Development Program(2019JZZY020127)

摘要:

有效的安全数据采集是精准分析网络威胁的基础,当前常用的全采集、概率采集和自适应采集等采集方法,未考虑采集数据的有效性和采集数据的关联关系,消耗过多的资源,其采集收益和成本率低。针对该问题,考虑影响采集收益和成本的因素(节点特征间关系、网络拓扑关系、系统威胁状况、节点资源情况、节点相似度等),设计了一种基于规则关联的安全数据采集策略生成方法。该方法根据节点间的关联规则和系统中所发生安全事件间的关联规则,构建备选采集项,缩减数据采集范围;综合考虑采集收益和采集成本,设计最大化采集收益和最小化采集成本的多目标优化函数,基于遗传算法求解该优化函数。与常用采集方法进行比较和分析,实验结果表明所提方法12 h累计数据采集量较其他方案减少了1 000~3 000条数据记录,数据有效性较其他数据采集方案提升约4%~10%,证明了所提方法的有效性。

关键词: 策略优化生成, 多目标优化, 数据协同采集, 多关联规则挖掘

Abstract:

Collecting security-related data of devices effectively is the foundation of analyzing network threats accurately.Existing data collection methods (full data collection, sampling based data collection and adaptive data collection) do not consider the validity of the collected data and their correlation, which will consume too much collection resources, resulting in low collection yield.To address this problem, considering the factors (relationship between node attributes, network topology relationship, threat status, node resource and node similarity) that impact collection costs and benefits, a rule association method to generate collection policies was designed.In the method, two types of association rules (inter-node association rules and inter-event association rules) were adopted to generate candidate data collection items and reduced the scope of data collection.Then, a multi-objective program was designed to maximize collection benefits and minimize collection costs.Further, a genetic algorithm was designed to solve this program.Proposed method was compared with existing data collection methods.The experimental results show that the number of the collected data records of proposed method is 1 000~3 000 less than that of others per 12 hours, and the validity of the collected data of proposed method is about 4%~10% higher than others, which proves the effectiveness of the proposed method.

Key words: policy optimization generation, multi-objective optimization, collaborative data collection, multiple class-association rules mining

中图分类号: 

No Suggested Reading articles found!