科学数据是科研活动的成果,也是后续科研创新的基础.科学数据共享和流动能够有效实现其价值最大化.目前,我国科学数据已经取得很大进展,但仍需全面加强科学数据建设,实现科学数据的"强国梦".与此同时,科学数据安全问题也日益严峻,"边共享边保护"的实践遇到前所未有的挑战,急需全面加强科学数据安全的系统研究、标准体系及基础标准的研制和实施.

To solve the problems that RoQ covert attacks are hidden in overwhelming background traffic and difficult to identify, besides the existing samples are scarce and cannot provide large-scale learning data, an unsupervised detection method of RoQ covert attacks based on multilayer features was proposed under the condition of very little prior knowledge.First, considering that most normal flow might interfere with subsequent results, a classification method based on semi-supervised spectral clustering was studied by flow characteristics, so that the proportion of normal samples in the filtered traffic was close to 100%.Secondly, in order to distinguish the nuance between the hidden attack features and normal flow without relying on the attack samples, an unsupervised detection model based on the n-Shapelet subsequence was constructed by packet characteristics, and the subsequences with obvious difference were used, which enabled detection of RoQ convert attacks.Experimental results demonstrate that with only a small number of learning samples, the proposed method has higher precision and recall rate than existing methods, and is robust to evading attacks.

随着僵尸网络的日益进化,检测和防范僵尸网络攻击成为网络安全研究的重要任务.现有的研究很少考虑到僵尸网络中的时序模式,并且在实时僵尸网络检测中效果不佳,也无法检测未知的僵尸网络.针对这些问题,本文提出了基于流量摘要的僵尸网络检测方法,首先将原始流数据按照源主机地址聚合,划分适当的时间窗口生成流量摘要记录,然后构建决策树、随机森林和XGBoost机器学习分类模型.在CTU-13数据集上的实验结果表明,本文提出的方法能够有效检测僵尸流量,并且能够检测未知僵尸网络,此外,借助Spark技术也能满足现实应用中快速检测的需要.

[目的]互联网的迅速发展给人们的生活带来了极大的便利,然而各种网络攻击行为也日益增加,网络空间面临着严重的威胁.入侵检测在防护网络攻击中发挥着关键作用.[文献范围]近年来,深度学习方法在入侵检测领域得到了广泛应用.本文通过广泛的文献调查,选取了该领域的最新研究工作.[方法]首先介绍了当前的网络安全形势,并总结了入侵检测系统的类型、数据集和评估方法,然后在检测技术层面,论述了基于传统机器学习方法的入侵检测和基于深度学习的入侵检测.最后,对入侵检测技术未来的研究方向进行了展望.[结果]通过分析对比,基于深度学习方法的入侵检测系统通常具有更好的性能.[局限]受限于获取文献的范围,没有对基于深度学习的入侵检测方法所解决的问题进行对比.[结论]基于深度学习方法的入侵检测技术在处理高维数据、获取数据中隐藏信息、解决网络中数据不平衡问题等方面具有优势,未来在入侵检测领域会应用地越来越广泛.

Intrusion detection Systems(IDS) can produce large amount of alert data which usually possesses the characteristics of high redundancy and high repetition. Such kind of data makes the event processing for network security significantly difficult. Current cluster algorithms use cluster center to calculate the distance which leads to fairly big calculation errors. In order to aggregate the massive alert data effectively and identify important security events accurately, we propose an improved Iterative Self-Organizing Data Analysis Techniques Algorithm based on Similarity Radius (SR-ISODATA). In the presented algorithm, optimal sequence comparison method is used to calculate the attribute weight of alert data, and different similarity calculation methods are chosen due to different properties of alert data; the merging and splitting criteria are revised, the clustering center in the original ISODATA algorithm is replaced by the average similarity radius and the distance calculation in the original algorithm is replaced by the similarity. Extensive experiments using the alert experimental data on KDDCUP99 show that the SR-ISODATA algorithm gets a high alert compression rate and a higher purity of each cluster.

Snort intrusion detection system based on features is analyzed. And based on this, the porting of Snort system into IPv6 network environments is implemented. To improve the speed and efficiency of intrusion detection engine in an intrusion detection system, the organizational structure and rules matching process of Snort are analyzed, and a dynamic rule matching mechanism for IPv6 is introduced. In order to adjust the sequence of rule matching dynamically and to improve the efficiency of rule matching, the rules of Snort rule option according to eigenvalue and common items are classified and a chain of fast item is associated with the rule option. The experiment shows that the system not only detects kinds of attacking for IPv6, but also increases average rule matching speed about 19.2%.