| The rapid development of society is inseparable from computer network.The Intermet and mobile terminals have brought a tremendous reform to current society.However,there exist potential threats when they bring us convenience in life.Network security is more important than ever before with the increasing dependence of daily life on the Internet,so there is no doubt about the importance of network security monitoring.The early proposed security methods mainly focused on the analysis of malware from static signature detection to dynamic behavior detection,and security analysis methods gradually develop from on-device to Off-device network behavior analysis.Otherwise,Deep packet inspection(DPI)of analyzing packets’ payload cannot be effective anymore with the widespread use of encryption protocols,so the analysis methods of network behavior have become the main research direction of network security monitoring against a background of network.Anomaly detection is a security analysis method based on network behavior.Its advantage is unknown-threats detection.However,there are two problems in existed anomaly detection approaches:the first one is that the existed approaches cannot process fine-grained network raw traffic.Anomaly detection can only process data collected by specific systems and large-scale network data,which limits the scope of anomaly detection application;the second one is that anomaly detection can only process static datasets manually,and cannot detect anomaly in dynamic stream.This thesis proposes a non-invasive detection approach for mobile terminals based on abnormal behavior pattern evolution to solve the above problems.In recent years,network behavior analysis has developed from coarse-grained to fine-grained,which is not limited to detect some known threats,and is inclined to discover unknown network malicious activity.Thus,a non-invasive detection approach is presented for mobile terminals based on abnormal behavior pattern evolution on this premise.This approach extracts the application fingerprintings of raw network traffic dynamically,which solves the problem that anomaly detection cannot process fine-grained raw data of network directly.Then,an improved anomaly detection method,evolution detection model,is proposed.An evolutionary standard of user behavior is established based on application fingerprintings and traffic classification results,which solves the problem that anomaly detection cannot detect dynamic data stream.The approach has the following characteristics:the non-invasive way is compatible with different mobile terminal systems,which doesn’t need to be installed on local devices,and protects users’ privacy to discover anomalies through the analysis of mobile terminals’ network behavior.Moreover,the analysis approach based on evolutionary abnormal behavior not only extracts real-time the characteristics of network encrypted traffic,but also can discover unknown threats with the deviation and evolution of network behavior.The main research contents and innovations of this thesis are as follows:1.Fine-grained High-utility dynamic fingerprinting(Huf)approach is proposed,and the approach’ innovation is a novel method for network traffic segment-IP address transition(IAT)to determine the "breakpoint" of network traffic.The approach of IAT can extract complete fine-grained fingerprinting,and change the existed problem of time-interval segment method,which can’t obtain fine-grained and complete application fingerprints.Otherwise,the fingerprinting of network behavior relied on manual analysis in the past,and the approach realizes dynamic extraction based on improved frequent itemset mining.By defining the utility of fingerprintings,the approach can extract typical fingerprinting with good classification effect,and prevent them from being obliterated by "low value" fingerprintings.Relevant experiments are carried out on two kinds of data sets:one is public test data,and the other is actual collected data.The performance and effect of this approach are proved by three kinds of analysis experiments:network traffic segment,accuracy and efficiency of fingerprinting extraction,and efficiency of high-utility fingerprinting extraction.2.A Length-ware constrained clustering Markov traffic classification(Lwt)approach is proposed.The existed network traffic classification methods based on Markov only analyzes the traffic classification in the complete stage of communication establishment,ignoring the traffic classification in the simplified stage of communication maintenance and the problem of a large number of duplications of fingerprintings in network.Therefore,this thesis applies Gaussian Mixture Model(GMM)to model the length of packets,and the model is established to solve the problem of fingerprinting duplication.The packets length of the same application is divided into as few clusters as possible by constrained clustering approach,which improves the convergence speed and clustering effect of the approach,and improves the way of searching the optimal clustering results by traversing in the existed methods.The experiment verifies the performance of the approach by three experiments:the computing time,clustering effect and network traffic classification.3.This thesis proposes a new approach of Sketch-based baseline evolution anomaly detection(Sbe).The existed methods can only obtain statistics of network traffic from macroscopical perspective and build Profile of network behavior.They cannot find fine-grained anomalies for individual mobile terminal,and cannot locate the position of anomalies accurately when anomalies occur.According to the classification results of network traffic,the approach proposed in this thesis establishes the Profile of mobile terminal behavior based on Sketch,constructs an evolutionary Baseline by extracting spatial and temporal features from Convolution neural network(CNN)and LSTM neural network of deep learning to find fine-grained anomalies and detect anomalies.The experiment includes the effect of Profile modeling and the effect of anomaly location detection to verify the proposed method.The main process of the non-invasive detection approach proposed in this thesis is to extract the characteristics of network traffic,i.e.fingerprinting,then classify the network traffic according to the application fingerprintings,and finally establish the Profile of network behavior based on the classification results and fingerprinting for detecting abnormal behavior. |
