CN1567853A - Network safety risk detection system and method - Google Patents

Abstract

The invention discloses a network safety risk detecting system and method, simulating the function of immunocytes in human immune system to real-timely monitor large-scale network activities, and according to the antibody concentration of the immunocytes, evaluating some attack risk and the whole risk that host computer are faced with, some attack risk that the whole network is face with and the whole risk that the whole network is faced with. It can makes real-time and quantitative risk evaluation on the network safety, and can learn by itself as detecting and monitoring the network so as to in time find new network attacking mode, and has a wide application prospect.

Description

Network security risk detection system and method

Technical field

The present invention relates to a kind of network security risk detection technique, belong to information security field.

Background technology

Traditional network security technology (as fire compartment wall etc.) is mainly based on Passive Defence, the attack that system is being suffered lacks real-time network security risk evaluation, thereby the defence policies of situation adjustment in real time oneself such as intensity of also just can not be targetedly initiatively being attacked according to current network and risk class.Real-time network security risk detects positive network security technology is had great importance.Traditional network security assessment means comprise mainly that to methods such as IDS sample analysis, manual evaluation and security audits thereof these methods lack real-time, can not quantitatively calculate, and have significant limitation.

The Chinese patent publication number is the application case of CN1412714A, by the method that analog hacker is attacked, to carried out the scanning of security breaches and hidden danger by check system, submits Risk Assessment Report to, and proposes corresponding adjustment measure.This method can only be carried out risk assessment to network security before assault, can not carry out real-time network security risk evaluation in assault, and can not detect existing mutation of attacking, and adaptive capacity is relatively poor.

Summary of the invention

The present invention proposes a kind of real-time network security risk detection system and method, can carry out real-time, quantitative risk assessment to network security, and to network measuring and when monitoring, can self-teaching, in time find new network attack pattern.

The corresponding relation that the present invention invades intensity according to the variation and the pathogen of AC among the human immune system proposes.

Network security risk detection system of the present invention, is made up of the risk evaluation module of network the risk evaluation module of main frame the intrusion detection module.Corresponding with the human immune system, the network activity of definition antigen for detecting is the proper network activity from body in the system, and non-is unusual network activity from body.Also defined immunocyte in the system, the functional module of immunocyte for network activity is detected in real time, antibody (being used for detecting the detection of antigens device) is present in the immunocyte, is used to detect antigen.Immunocyte is divided into memory immunocyte and maturation immunity cell, the maturation immunity cell is also not by the immunocyte of antigenic activation (not matching the antigen that specifies number in the regular hour), and the memory immunocyte is to be evolved and come by the maturation immunity cell that is activated.In system's running, immunocyte detects the antigen (network activity feature) of being offered (feature extraction is carried out in network activity) by antigen and obtaining.Immunocyte is subjected to antigenic stimulus (with the antigen coupling) and the enough affinity (the coupling number surpasses given threshold value) of accumulative total, this cell will be by clone (produce more multiclass like immunocyte to tackle more dead cat), this cell corresponding antibody concentration will improve simultaneously, immunocyte continues to be activated (suffering continuous attack), and then its AC will increase constantly.The immunocyte AC will keep in a hold period, if be not activated in the AC hold period, then corresponding antibodies concentration will decay to 0, can assess network security risk according to the AC of memory immunocyte like this.

Before describing in detail, some nouns that at first use in the define system, symbol and some formula:

(1) antigen set: establish antigen set A g={＜a, b〉| a ∈ D ∧ b ∈ ψ ∧ | a|=l ∧ a=APCs (b) }, wherein gather D={0,1} ^lL is normal natural number, set ψ is the IP bag set of online transmission, antigen in the similar immune system of APCs (b) is offered, and b carries out feature extraction to the IP bag: extracting length is the epitope (characteristic value) of the binary string (mainly being made up of the binary string of web transactions features such as source, purpose IP address, port numbers, protocol type, protocol status) of l as initial IP packet.

(2) from body and non-ly gather:, non-from body set Noself Ag from body S set elf Ag from body.Self ∪ Noself=Ag is arranged, Self ∩ Noself=Φ.To element x ∈ Ag arbitrarily, definition belongs to operator ∈ from body _APCsAnd

As follows:

(3) immunocyte set: definition immunocyte set B=＜d, p, age, count〉| d ∈ D, p ∈ R, age, count ∈ N}, wherein d is an antibody, p is an AC, age is the antibody age, and count is the antigen number that antibody matches, and R is a set of real numbers, and N is the nature manifold.Immunocyte is divided into maturation immunity cell T again _bWith memory immunocyte M _b, i.e. B=M _b∪ T _b, and M _b∩ T _b=Φ.

(4) affinity (affinity) computing function f _{R_con}(x, y): r position (r-contiguous bits) adaptation function is continuously adopted in suggestion, and computing formula is seen formula (2):

In addition, the affinity computing function also can adopt other functions, for example computing functions such as hamming distance, Euler's distance.

(5) prematurity immunocyte set: definition prematurity immunocyte set I _b=＜d, age〉| d ∈ D, age ∈ N).

(6) antibody gene storehouse: definition antibody gene storehouse Agd D, the antibody gene storehouse is mainly used in the antibody gene of the new prematurity immunocyte of generation in the marrow model.

(7) definition memory immunocyte M _bIn Consanguinity relation:

Consanguinity＝{<x，y>|x，y∈M _b∧f _{r_con}(x.d，y.d)＝1} (3)

(8) blood relation's class and maximum blood relation's class: establish and gather X M arbitrarily _b, to x arbitrarily, y ∈ X has＜x y〉and ∈ Consanguinity, claim that X be the blood relation's class by the Consanguinity generation.In addition, if X is the blood relation's class that is produced by Consanguinity, and M _bAny element among the-X all not with X in element exist and to concern Consanguinity, claim that then X is maximum blood relation's class.

(9) maximum blood relation's class is: establish π={ A ₁, A ₂..., A _n, ${\mathrm{<figure-callout\; id="1"\; label="M\; b"\; filenames="A20041002216000152.png,A20041002216000161.png"\; state="\{\{state\}\}">M</figure-callout>}}_b^{}=M_b,$ Make M _b' in the institute

There is maximum blood relation's class set to be combined into ${\mathrm{\&pi;}}^i=\{X_1^i,X_2^i,...,X_k^i\},$ Then $A_i\&Element;\left\{x\right|x\&Element;{\mathrm{\&pi;}}^{\&prime;},\left|x\right|=\underset{1\&le;t\&le;k}{\max }\left(\right|X_t^{\&prime;}\left|\right)\},$ Be A _lBe M _b' in have arbitrary maximum blood relation's class of maximum elements, and

Claim that so π is M _bIn maximum

Blood relation's class system.

In order to further specify principle of the present invention and feature, be described in detail below in conjunction with accompanying drawing.Fig. 1 is the system assumption diagram of system

Fig. 1 has shown the distribution (establish in protected network total K platform main frame) of whole system in network: intrusion detection module and the risk evaluation module of main frame is distributed on each main frame in the whole network is distributed on the risk assessment central server the risk evaluation module of network.The intrusion detection module detects the network activity of main frame, risk evaluation module to main frame is carried out risk assessment according to the AC of remembering immunocyte on the main frame to main frame, and the risk evaluation module of network is carried out risk assessment according to the AC of remembering immunocyte in the whole network to network.

Fig. 2 is the workflow diagram of intrusion detection module

The network invasion monitoring process is as follows:

(1) from the real network data flow, obtain the IP packet, extract the characteristic information (as information such as IP address, port numbers and agreements) of IP bag, constituting length is the binary string of l, regularly puts into set A g as antigen.

(2) antigen set A g is gathered M by the memory immunocyte _bDetect, from Ag, delete for non-antigen being detected, if the memory immunocyte detects from body just from M from body by the memory immunocyte _bMiddle deletion.

(3) with antigen set A g by maturation immunity cell aggregation T _bDetect, being that non-antigen from body is deleted from Ag by the maturation immunity cell detection, will being activated and joining memory immunocyte set M if the maturation immunity cell detects the antigen of some in certain cycle _bIn, if the maturation immunity cell is not activated in certain cycle or detects from body just from M _bMiddle deletion.

(4) the prematurity immunocyte is tolerated (deletion with from the cell of body sets match), successfully will join maturation immunity cell aggregation T if the prematurity immunocyte tolerates _bIn, otherwise will be dead.

(5) the prematurity immunocyte of generation some joins prematurity immunocyte set I _bIn, the antibody of newborn prematurity immunocyte generally is divided into several sections: a part of completely random produces (guaranteeing the diversity of antibody), another part antibody gene is by the gene code in the antibody gene storehouse, and Methods for Coding can adopt genetic operator etc.

(6) return (2).

In the network invasion monitoring process, the detailed process that the antigen set changes is described by equation (4)-(9).

${\mathrm{Ag}}_{\mathrm{Nonself}}\left(t\right)=\left\{x\right|x\&Element;\mathrm{Ag}\left(t\right),\&Exists;y\&Element;(M_{\mathrm{clone}}\left(t\right)\&cup;T_{\mathrm{clone}}\left(t\right))$

Ag _Self(t)＝Ag(t)-Ag _Nonself(t) (7)

Wherein δ is the update cycle of antigen set A g, and promptly every δ cycle Ag is all replaced by new antigen, Ag _NewBe the new antigen of collecting between twice antigen upgrades, Ag _Nonself(t) the non-self-antigen that is detected constantly for t.Q _Ag(t) for t constantly with a certain maturation immunity cell coupling but fail to make this immunocyte to be accumulated to the antigen of enough affinity.f _Check(y, x) (y ∈ B, x ∈ Ag) simulation immunocyte is to the classification effect of antigen: if immunocyte has mated antigen, and antigen belongs to Self (t-1), and promptly detecting one once was that antigen from body then returns 2; If the coupling but do not belong to Self (t-1), promptly detect a non-self-antigen and then return 1; If do not mate, then this antigen is known self-antigen, returns 0.f _{Costimulation}Simulate immune collaborative stimulation, indication works as whether pro-antigen is self-antigen, and external signal can be replying of system manager etc.

In real network environment, because the existence of security breaches after network security manager's mending-leakage, is considered to normal network activity meeting in the past and is under an embargo.In addition, As time goes on, the network manager may open more port for better service is provided, and more service is provided, and in other words, former forbidden network activity is allowed to now.Here introduce the problem that a network normal activity (from body) dynamically develops in time.Usually, for t constantly from the body set, for a last moment in the body set, remove the element that morphs, add simultaneously t newly-increased constantly from element of volume, can describe with equation (10)-(13) from the dynamic change of body set.

Self _New(t)=y|y be t increase newly constantly from the body string (12)

B(t)＝M _b(t)∪T _b(t)， t≥0 (13)

The antibody gene storehouse is mainly used in the gene that generates new prematurity immunocyte antibody, and the evolution situation in antibody gene storehouse can be described with equation (14)-(16).

D wherein _i∈ D (i=1 ..., k) be initial antibody gene storehouse, Agd _NewThe gene (detecting a kind of new attack first) of cell clone body during (t) for t moment immunocyte primary response, Agd _Dead(t) memory immunocyte (detecting an antigen that is proved to be from the body) gene that makes a mistake sure constantly for t.Agd _New(t) as the superiority inheritance gene it is added the antibody gene storehouse, be beneficial to when generating new antibody gene, might generate more outstanding antibody gene by evolvement methods such as legacy operators; And Agd _Dead(t) then be As time goes on to have adapted to the gene current network needs, mistake, that need eliminate.

Fig. 3 is the self-tolerance procedure chart of prematurity immunocyte

Newly-generated prematurity immunocyte does not match from body in the given tolerance phase and just changes the maturation immunity cell into.If the prematurity immunocyte is interim having matched from body of tolerance, will be dead.

Equation (17)-(20) are described the tolerance process of prematurity immunocyte in detail.

I _maturation(t)＝{x|x∈I _tolerance(t)∧x.age＞α} (19)

I _New(t)={ y ₁, y ₂..., y _ξ(20) I wherein _Tolerance(t) be that Self (t-1) experience is once tolerated the remaining immunocyte in back, α 〉=1 (constant) simulation tolerance phase, I _Maturation(t) go through α immunocyte that tolerates the after date maturation constantly for t.I _New(t) the new prematurity immunocyte that produces constantly for t.

Fig. 4 is the procedure chart of maturation immunity cell detection antigen

The process of maturation immunity cell detection antigen is as follows:

(1) antibody and the antigen in the maturation immunity cell mates, if do not match, this antigen enters the detection of next round, otherwise changes (2).

(2) judge whether the antigen match belongs to from the body set, if belong to then change (3), otherwise commentaries on classics (4).

(3) if determine that through collaborative the stimulation this antigen be from body, then this maturation immunity cell death simultaneously this antigen enter the detection of next round, otherwise commentaries on classics (4).

(4) delete this antigen.

(5) whether the coupling number of judging this maturation immunity cell surpasses certain threshold value beta, if surpass then this maturation immunity cell is cloned, is translated into the memory immunocyte and sends to other main frames in the network.

Equation (21)-(32) are described the testing process of maturation immunity cell in detail.

T _b′(t)＝T _b″(t)-P(t)∪T _b(t) (22)

T _b″(t)＝{y|y∈B∧(y.d＝x.d，y.p＝x.p，y.age＝x.age，y.count＝x.count+1，x∈P(t))} (23)

T _b″(t)＝{y|y∈B∧(y.d＝x.d，y.p＝x.p，y.age＝x.age+1，

(25)

y.count＝x.count，x∈T _b(t-1))}

T _new(t)＝{y|y∈B∧(y.d＝x.d，y.p＝0，y.age＝0，y.count＝0，x∈I _maturation(t))} (26)

T _clone(t)＝{x|x∈T _b(t)，x.count≥β} (28)

X ' ∈ T wherein _b, x _i' .d=f _Variation(x), x _i' .p=0, x _i' .age=0, x _i' .count=0

f _Variation(x)=and d ', d ' ∈ D wherein, x.d ≠ d ', f _{R_con}(x.d, d ')=1 (31)

Family (x)={ y|y ∈ B (t-1) ∧ x ≠ y ∧ f _{R_con}(x.d, y.d)=1} (32) T wherein _New(t) be the t immunocyte of the new maturation that produces from marrow constantly, T _{Clone_new}(t) immunocyte that newly produces for cell clone (going through variation, self-tolerance process, shown in equation 27,30), T _Clone(t) for will evolving constantly, t is the cell aggregation of memory immunocyte, T _Dead(t) for t constantly since in cell life cycle (λ) be not accumulated to the dead cell of enough affinity (β).

Fig. 5 detects the process of antigen for the memory immunocyte

The process that the memory immunocyte detects antigen is as follows:

(1) memory immunocyte and antigen mate, if do not match, give maturation immunity cell coupling, otherwise change (2).

(2) judge whether the antigen match belongs to from the body set, if belong to then change (3), otherwise commentaries on classics (4).

(3) if determine that through collaborative the stimulation this antigen be from body, then should the death of memory immunocyte and give the maturation immunity cell detection this antigen, otherwise commentaries on classics (4).

(4) delete this antigen, this memory immunocyte is cloned and increased the AC of this memory immunocyte.

Equation (33)-(41) are described the testing process of memory immunocyte in detail.

M _b′(t)＝M _b″(t)∪M _clone′(t) (34)

y.age＝x.age+1，y.count＝x.count，x∈M _b(t-1)-M _clone(t))}

M _clone′(t)＝{x|x∈M _b∧y∈M _clone(t)∧(x.d＝y.d，

(37)

x.p＝η+y.p，x.age＝0，x.count＝y.count+1}

M _new(t)＝{x|x∈M _b∧y∈T _clone(t)∧(x.d＝y.d，x.p＝η，x.age＝0，x.count＝y.count)} (39)

T _{other_machine_clone}(t)＝{x|x∈M _b∧y∈T′ _{other_machine_clone(t)}

(40)

∧(x.d＝y.d，x.p＝0，x.age＝0，x.count＝0)}

Wherein K is the main frame number in the current network

(41)

K is the numbering of this machine, T _Clonei ⁱ(t) be the T of i platform main frame _Clone(t) M wherein _New(t) be the new memory immunocyte that produces, M _Dead(t) for having mated a memory immunocyte that is proved to be from the antigen of body.T ' _{Other_machine_clone}(t) be t maturation immunity cell clone body set (not containing the clone who remembers immunocyte) constantly in the Computer Immune System of other machines in the t moment network, when ripe immunocyte is met antigen generation clone (detecting a new network attack), this cell clone is sent in the network on the every other machine simultaneously, so that being possessed, other machines resists the ability that similar antigen is attacked, T _{Other_machine_clone}(t) simulated the process (similar vaccination) of accepting vaccine from other machines.η (＞0) is a constant.λ ' is the hold period of memory immunocyte AC, if promptly should memory immunocyte in λ ' cycle time cloning more not, then its corresponding antibody concentration will decay until 0.

Fig. 6 is the risk evaluation module flow chart to main frame

To main frame k (the risk assessment process of 1≤k≤K) is as follows:

(1) computation host is remembered immunocyte set M constantly at t _b(t) maximum blood relation's class is π (t)={ A ₁(t), A ₂(t) ..., A _n(t) }, promptly the memory immunocyte is classified.

(2) main frame is attacked by the n class, appoints and gets A _iThe antibody A of the arbitrary element (t) _i ^Gene(t) feature of attacking as the i class, i=1,2 ..., n.

(3) each class is attacked calculating ${\mathrm{attack}}_i={\mathrm{\&alpha;}}_i\&CenterDot;\underset{x\&Element;A_i\left(t\right)}{\mathrm{\&Sigma;}}x.p,$ I=1 wherein, 2 ..., n, α _i(0≤α _i≤ 1) shows in the main frame

The i class is attacked A _i ^Gene(t) danger.

(4) according to attack _iValue specifically assess main frame k and face the risk size that the i class is attacked constantly at t.

(5) basis

Value specifically assess main frame k faces the risk of all attacks constantly at t size.

Fig. 7 is the risk evaluation module flow chart to network

Risk assessment process to whole network is as follows:

(1) calculates whole network in t memory immunocyte set constantly In maximum blood relation's class system

∏ (t)={ C ₁(t), C ₂(t) ..., C _m(t) }, promptly immunocyte is classified M _b ^k(t) be that main frame k gathers at t memory immunocyte constantly,

(2) whole network is attacked by the m class, appoints and gets C _iThe antibody C of the arbitrary element (t) _i ^Gene(t) feature of attacking as the i class, i=1,2 ..., m.

(3) each class is attacked calculating ${\mathrm{attack}}_i={\mathrm{\&alpha;}}_i\&CenterDot;\underset{x\&Element;C_i\left(t\right)}{\mathrm{\&Sigma;}}(x.p\&CenterDot;\underset{k\&Element;\left\{j\right|1\&le;j\&le;K,x\&Element;M_b^{\&prime;}\left(t\right)\}}{\mathrm{\&Sigma;}{\mathrm{\&beta;}}_k}),$ I=1 wherein, 2 ..., m,

α _l(0≤α _l≤ 1) shows that the i class is attacked G in the network _i ^Gene(t) danger, β _k(0≤β _k≤ 1) is the importance of main frame k in network.

(4) according to attack _iThe whole network of the concrete assessment of value face the size of the risk that the i class attacks constantly at t.

(5) basis The whole network of the concrete assessment of value face the size of the risk of all attacks constantly at t.

Claims (6)

1. network security risk detection system and method is characterized in that the step based on the network monitoring of immunity; Step to the risk assessment of main frame; Step to the risk assessment of network.

2. described network security risk detection system of claim 1 and method is characterized in that may further comprise the steps based on the step of the network monitoring of immunity:

The step that antigen is offered (feature extraction) is carried out in network activity;

The step that the antigen set is dynamically developed;

From the dynamic step that develops of body set;

The step of the evolution in antibody gene storehouse;

The memory immunocyte detects the step of antigen;

The step of maturation immunity cell detection antigen;

The step of prematurity immunocyte self-tolerance;

Immunocyte clone's step;

The step that the immunocyte AC changes.

3. the step of the described network monitoring based on immunity of claim 2 is characterized in that immunocyte clone's step may further comprise the steps:

The maturation immunity cell detects the step that the antigen of some is cloned in preset time;

Send it in other main frames in the network step during the maturation immunity cell clone as the memory immunocyte in other main frames;

The memory immunocyte detects the step that antigen is cloned;

Clone's immunocyte is through the step of variation and self-tolerance.

4. the step of the described network monitoring based on immunity of claim 2 is characterized in that the step that the immunocyte AC changes may further comprise the steps:

Maturation immunity cell antibody concentration is 0 step;

During the maturation immunity cell clone, improve the step of AC;

When the memory immunocyte detects antigen once more in certain cycle, the step that its AC continues to increase;

When the memory immunocyte does not detect antigen once more in certain cycle, the step that its AC is decayed.

5. described network security risk detection system of claim 1 and method is characterized in that the step of the risk assessment of main frame be may further comprise the steps:

The step of the memory immunocyte on the main frame being classified according to the method for maximum blood relation's class system;

Judge the attack type that main frame has suffered and the step of feature according to every class memory immunocyte;

Face the step of the risk of corresponding attack according to every class memory immunocyte AC assessment main frame;

The step of the overall risk that faces according to memory immunocyte AC all on main frame assessment main frame.

6. described network security risk detection system of claim 1 and method is characterized in that the step of the risk assessment of network be may further comprise the steps:

The step of the memory immunocyte in the network being classified according to the method for maximum blood relation's class system;

Judge the attack type that network has suffered and the step of feature according to every class memory immunocyte;

Assess the step of the risk of the corresponding attack of network faces according to every class memory immunocyte AC;

Assess the step of the overall risk of network faces according to memory immunocyte ACs all in the network.

Images