發(fā)布時(shí)間：2018-01-30 04:58

  本文關(guān)鍵詞： 粒計(jì)算 Vague集 �？臻g 網(wǎng)絡(luò)安全行為 網(wǎng)絡(luò)流量異常檢測(cè) 微博用戶(hù)分析　出處：《電子科技大學(xué)》2017年博士論文　論文類(lèi)型：學(xué)位論文

【摘要】：隨著移動(dòng)互聯(lián)網(wǎng)的高速發(fā)展,網(wǎng)絡(luò)已經(jīng)深入到了人們生活的方方面面。網(wǎng)絡(luò)出現(xiàn)任何故障(包括設(shè)備故障和遭受攻擊等)都會(huì)對(duì)生活工作造成巨大的影響。與此同時(shí),還面臨著互聯(lián)網(wǎng)信息的傳播速度與傳統(tǒng)媒體傳播相比有著巨大的優(yōu)勢(shì),短時(shí)間內(nèi)即可形成輿論導(dǎo)向,甚至影響到輿論的穩(wěn)定�！秶�(guó)家網(wǎng)絡(luò)空間安全戰(zhàn)略》從網(wǎng)絡(luò)通信基礎(chǔ)設(shè)施和信息安全與傳播兩個(gè)角度,定義了網(wǎng)絡(luò)空間安全戰(zhàn)略。一方面,要保障網(wǎng)絡(luò)通信基礎(chǔ)設(shè)施的安全;另一方面,要保障網(wǎng)絡(luò)信息的安全,以及網(wǎng)絡(luò)信息的真實(shí)可靠,不會(huì)誤導(dǎo)公眾,造成網(wǎng)絡(luò)群體事件。因此,為了從上述兩個(gè)角度來(lái)維護(hù)網(wǎng)絡(luò)空間的安全,需要對(duì)網(wǎng)絡(luò)中IP層和應(yīng)用層(特別是Web內(nèi)容)的用戶(hù)行為進(jìn)行分析挖掘,及時(shí)發(fā)現(xiàn)危害網(wǎng)絡(luò)空間安全的行為,保障網(wǎng)絡(luò)及相關(guān)應(yīng)用的正常運(yùn)行。粒計(jì)算理論具備強(qiáng)大的不完備信息處理能力,受到了學(xué)界的廣泛認(rèn)可。它在人工智能、深度學(xué)習(xí)、信息安全等領(lǐng)域有很高的應(yīng)用價(jià)值。本文基于粒計(jì)算理論,結(jié)合當(dāng)下對(duì)網(wǎng)絡(luò)空間安全的應(yīng)用背景,對(duì)網(wǎng)絡(luò)流量異常檢測(cè)和微博用戶(hù)行為分析開(kāi)展了研究,主要取得如下成果:(1)提出了基于動(dòng)態(tài)Vague集的網(wǎng)絡(luò)流量異常檢測(cè)算法在動(dòng)態(tài)Vague集的基礎(chǔ)上,提出了頻度因子模型和相關(guān)因子模型,解決了網(wǎng)絡(luò)流量異常檢測(cè)中面臨的不完備流數(shù)據(jù)難以有效分析的問(wèn)題。頻度因子模型基于頻度因子認(rèn)知計(jì)算而得到,與基礎(chǔ)認(rèn)知相結(jié)合后,形成動(dòng)態(tài)認(rèn)知Vague集,有利于處理隨時(shí)間變化而變化的場(chǎng)景;相關(guān)因子模型使用相關(guān)度的概念提高異常識(shí)別的準(zhǔn)確率,通過(guò)實(shí)驗(yàn)證明該算法在數(shù)據(jù)缺失達(dá)到80%以上時(shí),依然能夠保持較高的識(shí)別準(zhǔn)確率。(2)構(gòu)建了基于動(dòng)態(tài)認(rèn)知的微博用戶(hù)行為分析方法動(dòng)態(tài)認(rèn)知過(guò)程是粒層凝聚變化的過(guò)程。通過(guò)對(duì)特征屬性的動(dòng)態(tài)認(rèn)知,構(gòu)建粒層凝聚算法。動(dòng)態(tài)認(rèn)知具有靈活性的特點(diǎn),隨需求變化進(jìn)行粒層凝聚,形成滿(mǎn)足具體需求的認(rèn)知粒子凝聚。基于動(dòng)態(tài)認(rèn)知可以獲得對(duì)應(yīng)的粒層分析,進(jìn)而形成相關(guān)的粒層用于智能分類(lèi)等應(yīng)用。在此基礎(chǔ)上,將該方法應(yīng)用到微博用戶(hù)行為關(guān)系網(wǎng)絡(luò)構(gòu)建和微博用戶(hù)快速分類(lèi)之中,在選定的三種重要行為特征情況下,分類(lèi)準(zhǔn)確率并沒(méi)有明顯的降低,取得了很好的分類(lèi)效果。(3)設(shè)計(jì)了基于Spark技術(shù)的網(wǎng)絡(luò)安全行為分析平臺(tái)該平臺(tái)為了滿(mǎn)足處理數(shù)據(jù)來(lái)源的多樣性、數(shù)據(jù)采集點(diǎn)的分散性、數(shù)據(jù)處理的及時(shí)有效性,采用了基于Spark技術(shù)的準(zhǔn)在線分析方法,實(shí)時(shí)獲取網(wǎng)絡(luò)流量、Netflow數(shù)據(jù)、防火墻日志和Web數(shù)據(jù)等多源原始數(shù)據(jù),采用離線數(shù)據(jù)預(yù)處理和數(shù)據(jù)分析的方式得到分析結(jié)果。在告警決策方面,基于D-S方法和Vague集理論,提出了多源數(shù)據(jù)評(píng)估的方法,能夠有效地提高告警準(zhǔn)確率。同時(shí),該平臺(tái)還采用基于總線的方式,便于擴(kuò)展。
[Abstract]:With the rapid development of mobile Internet. The network has penetrated into every aspect of people's life. Any failure of the network (including equipment failure and attack) will have a great impact on life and work. At the same time. Also faces the Internet information dissemination speed compared with the traditional media dissemination has the huge superiority, the short time may form the public opinion direction. Even affect the stability of public opinion. The National Cyberspace Security Strategy defines the cyberspace security strategy from the perspectives of network communication infrastructure and information security and dissemination. To ensure the security of network communication infrastructure; On the other hand, to ensure the security of network information and the authenticity and reliability of network information, it will not mislead the public and cause network group events. Therefore, in order to maintain the security of cyberspace from the above two angles. It is necessary to analyze and mine the user behavior of IP layer and application layer (especially Web content) in order to discover the behavior that endangers the security of network space in time. The theory of granular computing has strong incomplete information processing ability and has been widely recognized by the academic community. It is in artificial intelligence, in-depth learning. Information security and other fields have a high application value. Based on granular computing theory, combined with the current application of cyberspace security background, network traffic anomaly detection and Weibo user behavior analysis are studied. The main achievements are as follows: 1) A network traffic anomaly detection algorithm based on dynamic Vague set is proposed. Based on the dynamic Vague set, the frequency factor model and the related factor model are proposed. It solves the problem that the incomplete flow data in network traffic anomaly detection is difficult to be analyzed effectively. The frequency factor model is based on the frequency factor cognitive calculation and combined with the basic cognition. The formation of dynamic cognitive Vague sets is beneficial to the processing of scenes that change with time. Correlation factor model uses the concept of correlation to improve the accuracy of anomaly recognition. Experiments show that the algorithm is more than 80% when the data is missing. Still able to maintain a high recognition accuracy. (2) the dynamic cognitive process of Weibo user behavior analysis method based on dynamic cognition is a process of agglomeration and change of grain layer. Dynamic cognition has the characteristics of flexibility, agglomeration with the change of demand, forming cognitive particle aggregation to meet specific needs. Based on dynamic cognition, corresponding granular analysis can be obtained. On the basis of this, the method is applied to the construction of Weibo user behavior relationship network and Weibo user fast classification. Under the selected three important behavioral characteristics, the classification accuracy did not decrease significantly. A network security behavior analysis platform based on Spark technology is designed. In order to meet the diversity of data sources, data collection points are distributed. The timely validity of data processing, the use of Spark technology based on the quasi-online analysis method, real-time access to network traffic flow data, firewall logs and Web data and other multi-source raw data. The analysis results are obtained by off-line data preprocessing and data analysis. Based on D-S method and Vague set theory, a multi-source data evaluation method is proposed. At the same time, the platform is based on bus and is easy to be extended.
【學(xué)位授予單位】：電子科技大學(xué)
【學(xué)位級(jí)別】：博士
【學(xué)位授予年份】：2017
【分類(lèi)號(hào)】：TP393.08

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 趙冬梅;李紅;;基于并行約簡(jiǎn)的網(wǎng)絡(luò)安全態(tài)勢(shì)要素提取方法[J];計(jì)算機(jī)應(yīng)用;2017年04期

2 龐幫艷;張艷敏;;基于粗糙集的公共網(wǎng)絡(luò)入侵檢測(cè)方法研究[J];現(xiàn)代電子技術(shù);2017年04期

3 陳興蜀;江天宇;曾雪梅;尹學(xué)淵;邵國(guó)林;;基于多維時(shí)間序列分析的網(wǎng)絡(luò)異常檢測(cè)[J];工程科學(xué)與技術(shù);2017年01期

4 吳信東;李毅;李磊;;在線社交網(wǎng)絡(luò)影響力分析[J];計(jì)算機(jī)學(xué)報(bào);2014年04期

5 劉殷雷;劉玉葆;陳程;;不確定性數(shù)據(jù)流上頻繁項(xiàng)集挖掘的有效算法[J];計(jì)算機(jī)研究與發(fā)展;2011年S3期

6 徐戈;王厚峰;;自然語(yǔ)言處理中主題模型的發(fā)展[J];計(jì)算機(jī)學(xué)報(bào);2011年08期

7 彭宇;羅清華;彭喜元;;UIDK-means:多維不確定性測(cè)量數(shù)據(jù)聚類(lèi)算法[J];儀器儀表學(xué)報(bào);2011年06期

8 張晨;金澈清;周傲英;;一種不確定數(shù)據(jù)流聚類(lèi)算法[J];軟件學(xué)報(bào);2010年09期

9 胡艷維;秦拯;張忠志;;基于模擬退火與K均值聚類(lèi)的入侵檢測(cè)算法[J];計(jì)算機(jī)科學(xué);2010年06期

10 陳松;王珊;周明天;;基于實(shí)時(shí)分析的網(wǎng)絡(luò)測(cè)量抽樣統(tǒng)計(jì)模型[J];電子學(xué)報(bào);2010年05期

相關(guān)博士學(xué)位論文 前2條

1 周穎杰;基于行為分析的通信網(wǎng)絡(luò)流量異常檢測(cè)與關(guān)聯(lián)分析[D];電子科技大學(xué);2013年

2 鄔書(shū)躍;基于支持向量機(jī)和貝葉斯分析技術(shù)的入侵檢測(cè)方法研究[D];中南大學(xué);2012年

相關(guān)碩士學(xué)位論文 前2條

1 葉琳;基于SVM的網(wǎng)絡(luò)流量異常檢測(cè)系統(tǒng)研究[D];云南大學(xué);2010年

2 韓景靈;基于協(xié)議的隱馬爾可夫網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)研究[D];山西大學(xué);2007年

，

本文編號(hào)：1475351