Cloud Computing-Based Forensic Analysis for Collaborative Network Security Management System

Internet security problems remain a major challenge with many security concerns such as Internet worms, spam, and phishing attacks. Botnets, well-organized distributed network attacks, consist of a large number of bots that generate huge volumes of spam or launch Distributed Denial of Service (DDoS) attacks on victim hosts. New emerging botnet attacks degrade the status of Internet security further. To address these problems, a practical collaborative network security management system is proposed with an effective collaborative Unified Threat Management (UTM) and traffic probers. A distributed security overlay network with a centralized security center leverages a peer-to-peer communication protocol used in the UTMs collaborative module and connects them virtually to exchange network events and security rules. Security functions for the UTM are retrofitted to share security rules. In this paper, we propose a design and implementation of a cloud-based security center for network security forensic analysis. We propose using cloud storage to keep collected traffic data and then processing it with cloud computing platforms to find the malicious attacks. As a practical example, phishing attack forensic analysis is presented and the required computing and storage resources are evaluated based on real trace data. The cloud-based security center can instruct each collaborative UTM and prober to collect events and raw traffic, send them back for deep analysis, and generate new security rules. These new security rules are enforced by collaborative UTM and the feedback events of such rules are returned to the security center. By this type of close-loop control, the collaborative network security management system can identify and address new distributed attacks more quickly and effectively.     

以视觉相似为基础的Phishing检测方法

目前检测网络欺诈均采用人工的方式。该文提出了一种基于EMD(earth move distance)算法的视觉相似度欺诈网页检测算法,算法将网页在像素级别的相似度比较结果作为依据,判断某网页是否为欺诈网页。在2个实际系统中应用和实践了该算法,通过对9280个网站进行检测,检测出欺诈的正确率为90.90%,结果显示该算法具有较高的欺诈检测精度以及较低的时间性能开销。