發(fā)布時間：2018-01-30 04:58

  本文關鍵詞： 粒計算 Vague集 �？臻g 網(wǎng)絡安全行為 網(wǎng)絡流量異常檢測 微博用戶分析　出處：《電子科技大學》2017年博士論文　論文類型：學位論文

【摘要】：隨著移動互聯(lián)網(wǎng)的高速發(fā)展,網(wǎng)絡已經(jīng)深入到了人們生活的方方面面。網(wǎng)絡出現(xiàn)任何故障(包括設備故障和遭受攻擊等)都會對生活工作造成巨大的影響。與此同時,還面臨著互聯(lián)網(wǎng)信息的傳播速度與傳統(tǒng)媒體傳播相比有著巨大的優(yōu)勢,短時間內(nèi)即可形成輿論導向,甚至影響到輿論的穩(wěn)定�！秶�家網(wǎng)絡空間安全戰(zhàn)略》從網(wǎng)絡通信基礎設施和信息安全與傳播兩個角度,定義了網(wǎng)絡空間安全戰(zhàn)略。一方面,要保障網(wǎng)絡通信基礎設施的安全;另一方面,要保障網(wǎng)絡信息的安全,以及網(wǎng)絡信息的真實可靠,不會誤導公眾,造成網(wǎng)絡群體事件。因此,為了從上述兩個角度來維護網(wǎng)絡空間的安全,需要對網(wǎng)絡中IP層和應用層(特別是Web內(nèi)容)的用戶行為進行分析挖掘,及時發(fā)現(xiàn)危害網(wǎng)絡空間安全的行為,保障網(wǎng)絡及相關應用的正常運行。粒計算理論具備強大的不完備信息處理能力,受到了學界的廣泛認可。它在人工智能、深度學習、信息安全等領域有很高的應用價值。本文基于粒計算理論,結合當下對網(wǎng)絡空間安全的應用背景,對網(wǎng)絡流量異常檢測和微博用戶行為分析開展了研究,主要取得如下成果:(1)提出了基于動態(tài)Vague集的網(wǎng)絡流量異常檢測算法在動態(tài)Vague集的基礎上,提出了頻度因子模型和相關因子模型,解決了網(wǎng)絡流量異常檢測中面臨的不完備流數(shù)據(jù)難以有效分析的問題。頻度因子模型基于頻度因子認知計算而得到,與基礎認知相結合后,形成動態(tài)認知Vague集,有利于處理隨時間變化而變化的場景;相關因子模型使用相關度的概念提高異常識別的準確率,通過實驗證明該算法在數(shù)據(jù)缺失達到80%以上時,依然能夠保持較高的識別準確率。(2)構建了基于動態(tài)認知的微博用戶行為分析方法動態(tài)認知過程是粒層凝聚變化的過程。通過對特征屬性的動態(tài)認知,構建粒層凝聚算法。動態(tài)認知具有靈活性的特點,隨需求變化進行粒層凝聚,形成滿足具體需求的認知粒子凝聚�；�于動態(tài)認知可以獲得對應的粒層分析,進而形成相關的粒層用于智能分類等應用。在此基礎上,將該方法應用到微博用戶行為關系網(wǎng)絡構建和微博用戶快速分類之中,在選定的三種重要行為特征情況下,分類準確率并沒有明顯的降低,取得了很好的分類效果。(3)設計了基于Spark技術的網(wǎng)絡安全行為分析平臺該平臺為了滿足處理數(shù)據(jù)來源的多樣性、數(shù)據(jù)采集點的分散性、數(shù)據(jù)處理的及時有效性,采用了基于Spark技術的準在線分析方法,實時獲取網(wǎng)絡流量、Netflow數(shù)據(jù)、防火墻日志和Web數(shù)據(jù)等多源原始數(shù)據(jù),采用離線數(shù)據(jù)預處理和數(shù)據(jù)分析的方式得到分析結果。在告警決策方面,基于D-S方法和Vague集理論,提出了多源數(shù)據(jù)評估的方法,能夠有效地提高告警準確率。同時,該平臺還采用基于總線的方式,便于擴展。
[Abstract]:With the rapid development of mobile Internet. The network has penetrated into every aspect of people's life. Any failure of the network (including equipment failure and attack) will have a great impact on life and work. At the same time. Also faces the Internet information dissemination speed compared with the traditional media dissemination has the huge superiority, the short time may form the public opinion direction. Even affect the stability of public opinion. The National Cyberspace Security Strategy defines the cyberspace security strategy from the perspectives of network communication infrastructure and information security and dissemination. To ensure the security of network communication infrastructure; On the other hand, to ensure the security of network information and the authenticity and reliability of network information, it will not mislead the public and cause network group events. Therefore, in order to maintain the security of cyberspace from the above two angles. It is necessary to analyze and mine the user behavior of IP layer and application layer (especially Web content) in order to discover the behavior that endangers the security of network space in time. The theory of granular computing has strong incomplete information processing ability and has been widely recognized by the academic community. It is in artificial intelligence, in-depth learning. Information security and other fields have a high application value. Based on granular computing theory, combined with the current application of cyberspace security background, network traffic anomaly detection and Weibo user behavior analysis are studied. The main achievements are as follows: 1) A network traffic anomaly detection algorithm based on dynamic Vague set is proposed. Based on the dynamic Vague set, the frequency factor model and the related factor model are proposed. It solves the problem that the incomplete flow data in network traffic anomaly detection is difficult to be analyzed effectively. The frequency factor model is based on the frequency factor cognitive calculation and combined with the basic cognition. The formation of dynamic cognitive Vague sets is beneficial to the processing of scenes that change with time. Correlation factor model uses the concept of correlation to improve the accuracy of anomaly recognition. Experiments show that the algorithm is more than 80% when the data is missing. Still able to maintain a high recognition accuracy. (2) the dynamic cognitive process of Weibo user behavior analysis method based on dynamic cognition is a process of agglomeration and change of grain layer. Dynamic cognition has the characteristics of flexibility, agglomeration with the change of demand, forming cognitive particle aggregation to meet specific needs. Based on dynamic cognition, corresponding granular analysis can be obtained. On the basis of this, the method is applied to the construction of Weibo user behavior relationship network and Weibo user fast classification. Under the selected three important behavioral characteristics, the classification accuracy did not decrease significantly. A network security behavior analysis platform based on Spark technology is designed. In order to meet the diversity of data sources, data collection points are distributed. The timely validity of data processing, the use of Spark technology based on the quasi-online analysis method, real-time access to network traffic flow data, firewall logs and Web data and other multi-source raw data. The analysis results are obtained by off-line data preprocessing and data analysis. Based on D-S method and Vague set theory, a multi-source data evaluation method is proposed. At the same time, the platform is based on bus and is easy to be extended.
【學位授予單位】：電子科技大學
【學位級別】：博士
【學位授予年份】：2017
【分類號】：TP393.08

【參考文獻】

相關期刊論文 前10條

1 趙冬梅;李紅;;基于并行約簡的網(wǎng)絡安全態(tài)勢要素提取方法[J];計算機應用;2017年04期

2 龐幫艷;張艷敏;;基于粗糙集的公共網(wǎng)絡入侵檢測方法研究[J];現(xiàn)代電子技術;2017年04期

3 陳興蜀;江天宇;曾雪梅;尹學淵;邵國林;;基于多維時間序列分析的網(wǎng)絡異常檢測[J];工程科學與技術;2017年01期

4 吳信東;李毅;李磊;;在線社交網(wǎng)絡影響力分析[J];計算機學報;2014年04期

5 劉殷雷;劉玉葆;陳程;;不確定性數(shù)據(jù)流上頻繁項集挖掘的有效算法[J];計算機研究與發(fā)展;2011年S3期

6 徐戈;王厚峰;;自然語言處理中主題模型的發(fā)展[J];計算機學報;2011年08期

7 彭宇;羅清華;彭喜元;;UIDK-means:多維不確定性測量數(shù)據(jù)聚類算法[J];儀器儀表學報;2011年06期

8 張晨;金澈清;周傲英;;一種不確定數(shù)據(jù)流聚類算法[J];軟件學報;2010年09期

9 胡艷維;秦拯;張忠志;;基于模擬退火與K均值聚類的入侵檢測算法[J];計算機科學;2010年06期

10 陳松;王珊;周明天;;基于實時分析的網(wǎng)絡測量抽樣統(tǒng)計模型[J];電子學報;2010年05期

相關博士學位論文 前2條

1 周穎杰;基于行為分析的通信網(wǎng)絡流量異常檢測與關聯(lián)分析[D];電子科技大學;2013年

2 鄔書躍;基于支持向量機和貝葉斯分析技術的入侵檢測方法研究[D];中南大學;2012年

相關碩士學位論文 前2條

1 葉琳;基于SVM的網(wǎng)絡流量異常檢測系統(tǒng)研究[D];云南大學;2010年

2 韓景靈;基于協(xié)議的隱馬爾可夫網(wǎng)絡入侵檢測系統(tǒng)研究[D];山西大學;2007年

，

本文編號：1475351