| With the vigorous development of the Internet,network security issues have become increasingly prominent.As a key basic resource of the Internet,domain names carry various network services provided by the Internet to users.Effective monitoring of these services is of great significance to ensure the safe and reliable operation of the network.According to the task requirements of network security situational awareness,on the basis of CERNET’s original security assurance system,this paper improves and perfects the DNS service monitoring work,and finally realizes the feature discovery of services in Jiangsu Education Network,which helps CERNET’s security situational awareness construction.In order to find out all the domain names representing the service from the domain name traffic,this paper designs a master-slave domain name identification algorithm.The algorithm can more accurately distinguish the primary domain name and secondary domain name in the domain name traffic,so as to screen out the primary domain name with service significance as the object of subsequent feature discovery,and improve the accuracy and efficiency of service monitoring.In order to obtain the behavior information of the services identified by these primary domain names,this paper takes the flow records provided by the IP activity database under the security assurance system as the data source,and selects service time,service space,service objects,service strength,data interaction,and service rhythm as features.Based on the extracted six dimensions,a total of 18 behavioral feature measures are proposed based on these dimensions,and the corresponding measurement methods for these measures are designed.The set of measure values measured by a service constitutes the behavioral feature set of the service,which is used to reflect the activity status of the service.In order to reflect the characteristics of the service more intuitively,this paper draws inspiration from user portraits and designs a labeling system to combine and reclassify the measurement values in the behavior feature set from the perspective of different behavior characteristics.By selecting appropriate tags and organizing them hierarchically,reasonably dividing tag semantics and studying the good mapping of service information to specific tag semantics,the construction of tag system is finally completed,thus realizing the display of service activity characteristics.Finally,the paper designs and implements a network service behavior characteristic observation system.The system applies the above research to service and service resource identification,service behavior feature extraction and service behavior feature expression modules,and provides users with query functions to effectively monitor services in the managed network. |
