关键词: 恶意网络行为, 事件流, 数据世系

Abstract: Because of the high concealment and long-term persistence of network attacks, these greatly limit the support of malicious network behavior detection for network attack identification, analysis and defense. To solve this problem, this paper proposes a method of malicious network behavior detection and traceability based on event stream data provenance. This paper uses event stream to characterize the network interaction between system and users or other systems, constructs data-driven event stream data provenance model, and establishes an anomaly detection algorithm oriented to the relativity of event stream data provenance from the perspective of interaction data flow. Then, this paper detects malicious network behavior events and traces malicious network behavior combination based on event stream data provenance, which can provide focused relational threat information for network attack analysis. Finally, the effectiveness of the method is verified by simulating the penetration attack of the combination of middleman and XSS.

Key words: malicious network behavior, event stream, data provenance