域名系统(domain name system,DNS)隐蔽信道是一种利用DNS协议实现数据泄露的网络攻击手段,受到诸多高级持续性威胁(advanced persistent threat,APT)组织的青睐,给网络空间安全带来了严重威胁。针对传统机器学习方法对特征依赖性强、...域名系统(domain name system,DNS)隐蔽信道是一种利用DNS协议实现数据泄露的网络攻击手段,受到诸多高级持续性威胁(advanced persistent threat,APT)组织的青睐,给网络空间安全带来了严重威胁。针对传统机器学习方法对特征依赖性强、误报率高的问题,提出一种融合多通道卷积和注意力网络的DNS隐蔽信道检测算法。该算法基于DNS请求与响应双向流,首先将残差结构和并行卷积相结合,采用不同大小的卷积核提取并融合多尺度特征信息,实现不同感受野特征的捕获;其次引入通道注意力机制增加卷积通道关键信息的提取能力,丰富网络模型的表达能力;最后采用softmax函数实现DNS隐蔽信道的检测。实验结果表明,所提模型能有效检测DNS隐蔽信道,平均准确率、精确率和召回率分别为96.42%、97.82%和96.16%,优于传统方法。展开更多
When traditional Intrusion Detection System(IDS) is used to detect and analyze the great flow data transfer in high-speed network,it usually causes the computation bottleneck. This paper presents a new Mobile Agent Di...When traditional Intrusion Detection System(IDS) is used to detect and analyze the great flow data transfer in high-speed network,it usually causes the computation bottleneck. This paper presents a new Mobile Agent Distributed IDS(MADIDS) system based on the mobile agents. This system is specifically designed to process the great flow data transfer in high-speed network. In MADIDS,the agents that are set at each node process the data transfer by distributed computation architecture. Meanwhile by using the reconfiguration quality of the mobile agents ,the load balance of distributed computation can be dynamically implemented to gain the high-performance computing ability. This ability makes the detecting and analyzing of high-speed network possible. MADIDS can effectively solve the detection and analysis performance bottleneck caused by the great flow data transfer in high-speed network. It enhances the performance of IDS in high-speed network. In this paper,we construct the infrastructure and theoretical model of MADIDS,and the deficiencies of MADIDS and future research work are also indicated.展开更多
文摘域名系统(domain name system,DNS)隐蔽信道是一种利用DNS协议实现数据泄露的网络攻击手段,受到诸多高级持续性威胁(advanced persistent threat,APT)组织的青睐,给网络空间安全带来了严重威胁。针对传统机器学习方法对特征依赖性强、误报率高的问题,提出一种融合多通道卷积和注意力网络的DNS隐蔽信道检测算法。该算法基于DNS请求与响应双向流,首先将残差结构和并行卷积相结合,采用不同大小的卷积核提取并融合多尺度特征信息,实现不同感受野特征的捕获;其次引入通道注意力机制增加卷积通道关键信息的提取能力,丰富网络模型的表达能力;最后采用softmax函数实现DNS隐蔽信道的检测。实验结果表明,所提模型能有效检测DNS隐蔽信道,平均准确率、精确率和召回率分别为96.42%、97.82%和96.16%,优于传统方法。
文摘When traditional Intrusion Detection System(IDS) is used to detect and analyze the great flow data transfer in high-speed network,it usually causes the computation bottleneck. This paper presents a new Mobile Agent Distributed IDS(MADIDS) system based on the mobile agents. This system is specifically designed to process the great flow data transfer in high-speed network. In MADIDS,the agents that are set at each node process the data transfer by distributed computation architecture. Meanwhile by using the reconfiguration quality of the mobile agents ,the load balance of distributed computation can be dynamically implemented to gain the high-performance computing ability. This ability makes the detecting and analyzing of high-speed network possible. MADIDS can effectively solve the detection and analysis performance bottleneck caused by the great flow data transfer in high-speed network. It enhances the performance of IDS in high-speed network. In this paper,we construct the infrastructure and theoretical model of MADIDS,and the deficiencies of MADIDS and future research work are also indicated.
