...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Future generation computer systems >An IP Traceback Protocol using a Compressed Hash Table, a Sinkhole Router and Data Mining based on Network Forensics against Network Attacks
【24h】

An IP Traceback Protocol using a Compressed Hash Table, a Sinkhole Router and Data Mining based on Network Forensics against Network Attacks

机译：使用压缩哈希表，Sinkhole路由器和基于网络取证的针对网络攻击的数据挖掘的IP回溯协议

获取原文
获取原文并翻译 | 示例
   

获取外文期刊封面封底 >>

       
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

The Source Path Isolation Engine (SPIE) is based on a bloom filter. The SPIE is designed to improve the memory efficiency by storing in a bloom filter the information on packets that are passing through routers, but the bloom filter must be initialized periodically because of its limited memory. Thus, there is a problem that the SPIE cannot trace back the attack packets that passed through the routers earlier. To address this problem, this paper proposes an IP Traceback Protocol (ITP) that uses a Compressed Hash Table, a Sinkhole Router and Data Mining based on network forensics against network attacks. The ITP embeds in routers the Compressed Hash Table Module (CHTM), which compresses the contents of a Hash Table and also stores the result in a database. This protocol can trace an attack back not only in real time using a hash table but also periodically using a Compressed Hash Table (CHT). Moreover, the ITP detects a replay attack by attaching time-stamps to the messages and verifies its integrity by hashing it. This protocol also strengthens the attack packet filtering function of routers for the System Manager to update the attack list in the routers periodically and improves the Attack Detection Rate using the association rule among the attack packets with an Apriori algorithm.
机译：源路径隔离引擎（SPIE）基于Bloom过滤器。 SPIE旨在通过在布隆过滤器中存储有关通过路由器的数据包的信息来提高内存效率，但是由于其有限的内存，必须定期初始化布隆过滤器。因此，存在一个问题，即SPIE无法追溯通过路由器的攻击数据包。为了解决这个问题，本文提出了一种IP追溯协议（ITP），该协议使用了压缩哈希表，Sinkhole路由器和基于网络取证的针对网络攻击的数据挖掘。 ITP在路由器中嵌入了压缩哈希表模块（CHTM），该模块可压缩哈希表的内容并将结果存储在数据库中。该协议不仅可以使用哈希表实时追溯攻击，还可以使用压缩哈希表（CHT）定期追溯攻击。此外，ITP通过将时间戳附加到消息来检测重播攻击，并通过对消息进行散列来验证其完整性。该协议还增强了路由器的攻击数据包过滤功能，以便系统管理器定期更新路由器中的攻击列表，并使用Apriori算法使用攻击数据包之间的关联规则提高攻击检测率。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号