自然着色聚类过程中的网络安全事件计算

自然着色过程利用有部分重叠的短比特串映射,使两个Hash函数间带有相同的颜色,为判定两个Hash串是否同源提供了重要依据.在商集映射的视角下分析了多个不同的聚类函数间的差异和着色关系,结果表明聚类函数间的内部平衡性结合自然着色过程可以得到源串部分比特串的聚类特性,同时TCP宏观平衡性仍然保持不变.实验表明,利用这个特性可以从多个具有着色关系的短比特串映射的Hash存储空间得到如蠕虫爆发、DDoS之类的TCP宏观异常中发起者、受害者的聚类信息.因此自然着色过程大大扩展了TCP宏观平衡性的应用领域,为网络安全检测、监测和安全事件分布评估提供了有力的支持.

The Calculation of Networking Security Event in the Natural Colored Information Reconstruction Process

The natural coloring process builds the coloring relationship among different hash functions by the overlapped Short Bit String Mappings,which can be used to determine whether two hash strings are from the same original string.The aggregation relationship and coloring relationship are analyzed from the view point of Quotient set mapping,it suggests that combined with inner balance of Hash functions,the natural coloring process can disclose more bits of original string in the multi Hash aggregation,in the meanwhile the quantity balance of TCP packets is kept.This character of the natural coloring process can be used to detect the IP address(es) and/or port information of victims and/or attackers of TCP macroscopical abnormal behavior such as DDoS,internet worm etc.,the conclusion is validated by the results of two experiments in the real traces.So the natural coloring process extends the application field of quantity balance of TCP packets greatly in networking security event distribution calculation/monitoring fields.