cyber situational awareness through operational streaming：通过业务流的网络态势感知.pdfVIP

The 2011 Military Communications Conference - Track 3 - Cyber Security and Network Operations Cyber Situational Awareness through Operational Streaming Analysis William W. Streilein John Truelove Chad R. Meiners Gregory Eakman MIT Lincoln Laboratory 244 Wood Street, Lexington, MA 02420 wws, jtruelove, chad.meiners, greg.eakman@ Abstract—As the scope and scale of Internet traffic continue deployed on an operational network, and stands as an end-to- to increase the task of maintaining cyber situational awareness end characterization environment, that passively monitors and about this traffic becomes ever more difficult. There is strong characterizes high-speed / high-volume network traffic in order need for real-time on-line algorithms that characterize high-speed / high-volume data to support relevant situational awareness. to provide indications of anomalous behavior for network and Recently, much work has been done to create and improve system analysts and administrators. analysis algorithms that operate in a streaming fashion (minimal CPU and memory utilization) in order to calculate important Our system consists of three main stages: a filtering stage, summary statistics (moments) of this network data for the pur- which finds and selects the Top- producers of traffic on the pose of characterization. While the research literature contains improvements to streaming algorithms in terms of efficiency and network; a trending and anomaly detection stage, which tracks accuracy (i.e. approximation with error bounds), the literature and monitors selected traffic for anomalous