SGER: Behavioral Authentication of Server Flows

SGER：用于检测异常通信模式的服务器流行为验证本项目的目标是开发用于分析服务器流的流量行为以检测异常通信模式的方法。应用于计算机安全的数据挖掘之前的工作是为了发现攻击数据包，而本研究的目的是发现指示应用层协议异常行为的流量模式。传统的确定流量类型的方法依赖于在TCP/UDP数据包头中携带的端口标签。但是，如果存在重新映射端口号的代理服务器，或者作为后门或秘密通道而受到危害的主机服务，此方法可能会失败。此探索性项目的基础是使用捕获流行为的功能对TCP服务器流通信进行分类。这些功能独立于端口标签，因此在存在恶意活动的情况下提供了更准确的流量类型分类。这项研究中一个令人兴奋的新方向是对服务器流进行身份验证，以检测异常和潜在的恶意行为。本研究解决了对应用层协议进行身份验证的需求。由于大多数入侵检测系统和防火墙依赖于了解应用程序协议来确定是否允许流量和发现恶意行为，因此这项研究填补了当前信息安全技术的一个关键空白。预期结果将在严重依赖可靠、有效和高效的信息安全的广泛应用中产生广泛影响。该项目的结果将在项目网站http://mow.ecn.purdue.edu/~lrn/，上查阅，并在安全会议上传播。

SGER: Behavioral Authentication of Server Flows for Detection of Anomalous Communication PatternsThe goal of this project is to develop methods for analyzing traffic behavior of server flows to detect anomalous communication patterns. Prior work in data mining applied to computer security was geared at finding attack packets, whereas this research aims to find patterns of traffic that indicate anomalous behavior of an application-layer protocol. Traditional methods for determining traffic type rely on the port label carried in the TCP/UDP packet header. This method can fail, however, in the presence of proxy servers that re-map port numbers, or host services that have been compromised to act as back doors or covert channels. The basis for this exploratory project is the classification of TCP server stream traffic using features that capture stream behavior. The features are independent of port label, and therefore, provide a more accurate classification of traffic type in the presence of malicious activity. An exciting new direction in this research is the authentication of server flows to detect anomalous and potentially malicious behavior. This research addresses the need for authentication of the application-layer protocol. Because most intrusion detection systems and firewalls rely on knowing the application protocol for determining whether to permit the traffic and for discovering malicious behavior, this research fills a critical gap in current information security technology. The expected results will have broad impact in a wide range of applications that critically depend on reliable, effective and efficient information security. Results of this project will accessible on the project web site http://mow.ecn.purdue.edu/~lrn/, and disseminated at Security Conferences.