摘要
为了提高安全事件应急响应的效率,设计并实现了一个入侵检测与取证分析自动化响应模型.该模型基于特定的安全事件信息,使用OpenFlow交换机实现报文的过滤和转发,利用PF-RING ZC零拷贝工具自动采集报文流量,使用开源入侵检测软件Suricata和多特征关联冗余消除算法完成对网络流量的入侵检测和警报冗余消除,同时结合Bro系统进行应用层协议分析以完成对网络流量的取证分析,可显著减少人工的干预.通过僵尸主机的检测实例对该模型进行了验证,结果表明了该模型对于提升安全事件应急响应效率的有效性.
To improve the efficiency of the security incident response,an intrusion detection and forensic analysis automation response model was designed and implemented.The model was based on the particular security event information,OpenFlow switches were used for packet filtering and forwarding,PF-RING ZC Zero-Copy tool was used to automatically collect packet traffic,and open source intrusion detection software Suricata and multi-feature associated redundancy elimination algorithm were used to complete network intrusion detection and redundance elimination of intrusion event.Bro system was combined with application layer protocol analysis to complete forensic analysis of network traffic,which could significantly reduce manual intervention.Various parts of the automated response model were analyzed in detail by bots detected experiment,the results show the effectiveness of the model for enhancing the efficiency of the security incident response.
作者
龚俭
王卓然
苏琪
杨望
Gong Jian Wang Zhuoran Su Qi Yang Wang(School of Computer Science and Engineering, Southeast University, Nanjing 211189, China)
出处
《华中科技大学学报（自然科学版）》
EI
CAS
CSCD
北大核心
2016年第11期30-33,共4页
Journal of Huazhong University of Science and Technology(Natural Science Edition)
基金
国家自然科学基金资助项目(61602114)
关键词
安全事件
应急响应
入侵检测
冗余消除
取证分析
security incidents
emergency response
intrusion detection
redundancy elimination
forensic analysis
