高菲

摘 要：传统的网络恶意攻击取证方法对恶意攻击行为的检查不全面、恶意攻击行为相似度分辨准确性低。为此，提出了一种分布式异构网络恶意攻击取证及预警方法。利用CVSS计算器对网络恶意攻击行为的严重等级进行评估，结合灰关联分析法建立灰关联模型，对评估要素进行量化处理;在此基础上，获取并处理日志、事件、警告和证据信息，建立证据库。根据取证结果，结合TOP-K预警策略实现分布式异构网络恶意攻击的预警和预警信息储存。实验结果表明，所提方法对恶意攻击行为的查全率和恶意攻击行为相似度分辨的准确性较高，且预警反应耗时较短，不仅能够准确检测恶意攻击行为，还能够及时发出警报，有效维持分布式异构网络的安全性。

关键词：分布式异构网络;网络恶意攻击;差异信息;灰关联模型

中图分类号：TP337      文献标识码：A

Research on Forensics and Forewarning Methods

of Distributed Heterogeneous Network Malicious Attacks

GAO Fei

（Skills Training Center，State Grid Jibei Electric Power Company Limited

（Baoding Electric Power Voc.& Tech. College）， Baoding，Hebei 071051， China）

Abstract：The traditional network malicious attack forensics method for malicious attack behavior inspection is not comprehensive， malicious attack behavior similarity discrimination accuracy is low. Therefore， this study proposes a distributed heterogeneous network malicious attack forensics and warning method. CVSS calculator was used to evaluate the severity of malicious network attacks， and gray correlation analysis method was used to establish a gray correlation model to quantify the evaluation factors. On this basis， obtain and process log， event， warning and evidence information， establish evidence base. According to the forensics results， TOP-K warning strategy is combined to realize the warning and warning information storage of distributed heterogeneous network malicious attack. The experimental results show that the proposed method is more accurate in detecting the malicious attack and distinguishing the similarity degree of the malicious attack， and the early-warning response time is shorter. It can not only accurately detect the malicious attack， but also send out the alarm in time， effectively maintaining the security of distributed heterogeneous network.

Key words：distributed heterogeneous network; malicious network attacks; difference information; grey relational model

為有效保障网络运行的安全性、更好地抵御非自体入侵行为和恶意攻击行为，需对网络恶意攻击进行动态实时取证[1]。分布式异构网络中恶意攻击行为的取证是使用合理的方法对数据证据进行收集、检查和分析，这些证据涉及到多层次的主动处理过程。取证的目的是为了及时发现网络中的恶意攻击行为，为网络安全故障的应急处理提供有效支持[2]。若发现网络中存在或可能存在恶意攻击行为，则通过有效、及时地预警防止网络威胁的进一步扩大。

传统的网络恶意攻击取证方法多采用基本过程模型将已知攻击证据作为证据来源，主要强调从电子数据中提取到的证据[3]，但更主要的是强调发现攻击行为发生后将网络恢复到初始状态。……