复杂网络环境下面向威胁监测的采集策略精化方法

doi:10.11959/j.issn.1000-436x.2019096

通信学报 ›› 2019, Vol. 40 ›› Issue (4): 49-61.doi: 10.11959/j.issn.1000-436x.2019096

复杂网络环境下面向威胁监测的采集策略精化方法

李凤华^1,^2,³,李子孚^1,²,李凌^1,²,张铭⁴,耿魁¹,郭云川¹()

¹ 中国科学院信息工程研究所，北京 100093
² 中国科学院大学网络空间安全学院，北京 100049
³ 通信网信息传输与分发技术重点实验室，河北石家庄 050081
⁴ 西安电子科技大学网络与信息安全学院，陕西西安 710071

修回日期:2019-03-23 出版日期:2019-04-25 发布日期:2019-05-05
作者简介:李凤华（1966- ），男，湖北浠水人，博士，中国科学院研究员、博士生导师，主要研究方向为网络与系统安全、信息保护、隐私计算。|李子孚（1992- ），女，内蒙古赤峰人，中国科学院博士生，主要研究方向为访问控制、安全策略管理。|李凌（1993- ），女，湖南浏阳人，中国科学院硕士生，主要研究方向为安全策略管理。|张铭（1997- ），男，浙江宁波人，主要研究方向为访问控制。|耿魁（1989- ），男，湖北红安人，博士，中国科学院助理研究员，主要研究方向为网络安全。|郭云川（1977- ），男，四川营山人，博士，中国科学院副研究员、博士生导师，主要研究方向为访问控制、形式化方法。
基金资助:
国家重点研发计划基金资助项目(2016YFB0801001);国家自然科学基金资助项目(61672515);中国科学院大学生创新实践训练计划基金资助项目

Collection policy refining method for threat monitoring in complex network environment

Fenghua LI^1,^2,³,Zifu LI^1,²,Ling LI^1,²,Ming ZHANG⁴,Kui GENG¹,Yunchuan GUO¹()

¹ Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China
² School of Cyber Security,University of Chinese Academy of Sciences,Beijing 100049,China
³ Science and Technology on Communication Networks Laboratory,Shijiazhuang 050081,China
⁴ School of Cyber Engineering,Xidian University,Xi’an 710071,China

Revised:2019-03-23 Online:2019-04-25 Published:2019-05-05
Supported by:
The National Key Research and Development Program of China(2016YFB0801001);The National Natural Science Foundation of China(61672515);Innovative Practice Project of College Students in Chinese Academy of Sciences

摘要/Abstract

摘要：

个性化采集策略是有效监测复杂网络环境面临的威胁的必要条件之一，然而安全需求和威胁类型差异等导致难以有效生成个性化的采集策略。针对上述问题，设计了面向威胁监测的采集策略自动精化方法。首先，提出了采集策略层次模型；然后，将威胁类型到采集项的精化转化为采集收益和采集成本平衡的非线性优化问题，并利用遗传算法进行求解；最后，通过模拟实验，验证可根据高层监测需求自动生成采集方案。

关键词: 数据采集, 威胁监测, 策略精化, 混合优化

Abstract:

Personalized collect policy is one of the necessary conditions for effectively monitoring threats in the complex network environment.However,differences in security requirements and threat types make it difficult to effectively generate personalized collect policy.To address the above problem,a collection policy automatic refinement method was designed.Firstly,a hierarchical model of collection policy was proposed.Then,by transforming the policy refinement into a nonlinear optimization problem,a genetic algorithm was designed to balance between collection revenue and collection cost.Finally,simulation experiments verify that according to the requirements of high-level monitoring,the acquisition scheme can be automatically generated.

Key words: data collection, threat monitoring, policy refinement, hybrid optimization

中图分类号:

TP302

李凤华,李子孚,李凌,张铭,耿魁,郭云川. 复杂网络环境下面向威胁监测的采集策略精化方法[J]. 通信学报, 2019, 40(4): 49-61.

Fenghua LI,Zifu LI,Ling LI,Ming ZHANG,Kui GENG,Yunchuan GUO. Collection policy refining method for threat monitoring in complex network environment[J]. Journal on Communications, 2019, 40(4): 49-61.

图/表 11

图1

图2

图3

图4

表1

表2

图5

图6

图7

图8

图9

参考文献 32

[1]	李凤华, 熊金波 . 复杂网络环境下访问控制技术[M]. 北京: 人民邮电出版社, 2015.
	LI F H , XIONG J B . Access control technology in complex network environment[M]. Beijing: Posts ＆ Telecom PressPress, 2015.
[2]	PADHY P , DASH R K , MARTINEZ K ,et al. A utility-based sensing and communication model for a glacial sensor network[C]// The 5th International Joint Conference on Autonomous Agents and Multi-agent Systems. 2016: 1353-1360.
[3]	曾文序, 库少平, 郑浩 . 基于旋转门算法的自适应变频数据采集策略[J]. 计算机应用研究, 2018,35(3): 769-772.
	ZENG W X , KU S P , ZHENG H . Strategy of self-adaptive frequency conversion data acquisition based on swing door trending algorithm[J]. Application Research of Computers, 2018,35(3): 769-772.
[4]	张斌, 朱建涛, 徐曌 . 基于动态频率算法的远程监控系统数据采集优化策略[J]. 微电子学与计算机, 2016,33(8): 86-91.
	ZHANG B , ZHU J T , XU Z . Data gathering optimization strategy based on dynamic frequency algorithm for remote monitoring system[J]. Microelectronics ＆ Computer, 2016,33(8): 86-91.
[5]	MAULLO M , CALO S . Policy management:an architecture and approach[C]// The 1st International Workshop on Systems Management. 1993: 13-26.
[6]	MONT M C , BALDWIN A , GOH C . Power prototype:towards integrated policy-based management[C]// IEEE/IFIP Network Operations and Management Symposium. 2000: 789-802.
[7]	ALBUQUERQUE J P D , KRUMM H , GEUS P L D ,et al. Scalable model-based configuration management of security services in complex enterprise networks[J]. Software:Practice and Experience, 2011,41(3): 307-338.
[8]	ALBUQUERQUE J P D , KRUMM H , GEUS P L D . Formal validation of automated policy refinement in the management of network security systems[J]. International Journal of Information Security, 2010,9(2): 99-125.
[9]	ROMEIKAT R , BAUER B . Specification and refinement of domain-specific ECA policies[C]// International Conference on Advanced Information Systems Engineering Workshops. 2011: 197-206.
[10]	NEISSE R , STERI G , GENEIATAKIS D ,et al. A privacy enforcing framework for Android applications[J]. Computers ＆ Security, 2016,62: 257-277.
[11]	RUDOLPH M , FETH D , DOERR J ,et al. Requirements elicitation and derivation of security policy templates—an Industrial case study[C]// The 24th International Requirements Engineering Conference. 2016: 283-292.
[12]	GUARDA P , RANISE S , SISWANTORO H . Security analysis and legal compliance checking for the design of privacy-friendly information systems[C]// The 22nd ACM on Symposium on Access Control Models and Technologies. 2017: 247-254.
[13]	RUDOLPH M , MOUCHA C , FETH D . A framework for generating user and domain-tailored security policy editors[C]// The 24th International Requirements Engineering Conference Workshops. 2016: 56-61.
[14]	BEIGI M S , CALO S , VERMA D . Policy transformation techniques in policy-based systems management[C]// The 5th IEEE International Workshop on Policies for Distributed Systems and Networks. 2004: 1-10.
[15]	HAN W , FANG Z , YANG L T ,et al. Collaborative policy administration[J]. IEEE Transactions on Parallel and Distributed Systems, 2014,25(2): 498-507.
[16]	UDUPI Y B , SAHAI A , SINGHAL S . A classification-based approach to policy refinement[C]// The 10th IFIP/IEEE International Symposium on Integrated Network Management. 2007: 785-788.
[17]	RIEKSTIN A C , JANUáRIO G C , RODRIGUES B B ,et al. Orchestration of energy efficiency capabilities in networks[J]. Journal of Network and Computer Applications, 2016,59: 74-87.
[18]	SCHEID E J , MACHADO C C , FRANCO M L ,et al. INSpIRE:integrated NFV-based intent refinement environment[C]// IFIP/IEEE Symposium on Integrated Network and Service Management. 2017: 186-194.
[19]	RANA A I , JENNINGS B . Semantic aware processing of user defined inference rules to manage home networks[J]. Journal of Network and Computer Applications, 2017,79: 68-87.
[20]	MACHADO C C , WICKBOLDT J A GRANVILLE L Z ,et al. ARKHAM:an advanced refinement toolkit for handling service level agreements in Software-Defined Networking[J]. Journal of Network and Computer Applications, 2017,90: 1-16.
[21]	RIEKSTIN A C , JANUáRIO G C , RODRIGUES B B ,et al. A survey of policy refinement methods as a support for sustainable networks[J]. IEEE Communications Surveys and Tutorials, 2016,18(1): 222-235.
[22]	AZIZ B . Modelling fine-grained access control policies in grids[J]. Journal of Grid Computing, 2016,14(3): 477-493.
[23]	BANDARA K , LUPU E C , RUSSO A . Using event calculus to formalise policy specification and analysis[C]// The 4th International Workshop on Policies for Distributed Systems and Networks. 2003: 26-39.
[24]	CRAVEN R , LOBO J , LUPU E ,et al. Policy refinement:decomposition and operationalization for dynamic domains[C]// The 7th International Conference on Network and Services Management. 2011: 115-123.
[25]	RUBIO-LOYOLA J . Towards the policy refinement problem in policy-based management systems[M]. Saarbrücken: VDM VerlagPress, 2008.
[26]	LEIGHTON G , BARBOSA D . Access control policy translation,verification,and minimization within heterogeneous data federations[J]. ACM Transactions on Information and System Security, 2011,14(3): 1-28.
[27]	JOHNSON M , KARAT J , KARAT C M ,et al. Usable policy template authoring for iterative policy refinement[C]// IEEE International Symposium on Policies for Distributed Systems and Networks. 2010: 18-21.
[28]	CHUNG L , NIXON B A , YU E ,et al. Non-functional requirements in software engineering[M]. New York: Springer Publishing CompanyPress, 2000.
[29]	LIPPMANN R , HAINES J W , FRIED D J ,et al. The 1999 DARPA off-line Intrusion Detection Evaluation[J]. Computer Networks, 2000,34(4): 579-595.
[30]	AFFLECK A , KRISHNA A . Supporting quantitative reasoning of non-functional requirements:a process-oriented approach[C]// International Conference on Software and System Process. 2012: 88-92.
[31]	KAMRAN S , ZAHID A , FARRUKH A K ,et al. KDD cup 99 data sets:a perspective on the role of data sets in network intrusion detection research[J]. Computer, 2019,52(2): 41-51.
[32]	窦全胜, 陈姝颖 . 演化计算方法及应用[M]. 北京: 电子工业出版社, 2016.
	DOU Q S , CHEN S Y . Evolutionary calculation method and application[M]. Beijing: Publishing House of Electronics IndustryPress, 2016.

采集项名称	DDoS	非法访问	流量异常	FTP木马
系统日志	0.80	0.50	0.60	0.20
FTP服务日志	0.10	1 .00	0.10	1.00
端到端的IP流量	1.00	0.10	1.00	0.20
特定服务的业务流量	0.40	1.00	0.80	1.00
CPU占用率	0.80	0.40	0.80	0.40
内存利用率	0.60	0.30	0.60	0.30

采集项名称	计算成本常量	存储成本常量	传输成本常量
系统日志	0.100	0.192	0.192
FTP服务日志	0.100	0.128	0.128
端到端的IP流量	0.200	0.300	0.300
特定服务的业务流量	0.600	0.128	0.128
CPU占用率	0.300	0.040	0.040
内存利用率	0.300	0.040	0.040

复杂网络环境下面向威胁监测的采集策略精化方法

Collection policy refining method for threat monitoring in complex network environment

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献 32

相关文章 11

Metrics

推荐阅读 0

[1]	俸皓,罗蕾,王勇,叶苗. 无线传感网中基于时变多旅行商和遗传算法的多目标数据采集策略[J]. 通信学报, 2017, 38(3): 112-123.
[2]	殷丽华,郭云川,张会兵. 基于拍卖的物联网搜索数据提供机制[J]. 通信学报, 2015, 36(12): 37-46.
[3]	丁煦,韩江洪,石雷,夏伟,魏振春. 可充电无线传感器网络动态拓扑问题研究[J]. 通信学报, 2015, 36(1): 129-141.
[4]	卢先领,王莹莹. 时延受限的移动sink数据收集算法[J]. 通信学报, 2014, 35(10): 107-116.
[5]	卢先领，王莹莹. 时延受限的移动sink数据收集算法[J]. 通信学报, 2014, 35(10): 13-116.
[6]	郭剑,孙力娟,许文君,王汝传,肖甫. 基于移动sink的无线传感器网络数据采集方案[J]. 通信学报, 2012, 33(9): 176-184.
[7]	朱敬华,王桐,钟颖莉. 无线传感器网络能源高效的移动数据采集协议[J]. 通信学报, 2011, 32(9A): 70-76.
[8]	秦建存,陈常嘉,谷裕. 数据采集型传感器网络结构的生成机制研究[J]. 通信学报, 2010, 31(1): 105-111.
[9]	张令文,谈振辉. 基于秦勒级数展开的蜂窝TDOA定位新算法[J]. 通信学报, 2007, 28(6): 9-14.
[10]	孔师今,何涛,李星,刘奖. 高速网络数据采集和归并系统[J]. 通信学报, 2005, 26(1A): 14-17.
[11]	卢丽丽,赵永生,侯峥,朱婧,张文佳,初彦龙. GSM技术在热网远程抄表系统中的应用[J]. 通信学报, 2005, 26(1A): 202-204.