{"id":5624,"date":"2022-11-29T16:52:49","date_gmt":"2022-11-29T08:07:49","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=5624"},"modified":"2022-11-29T16:54:26","modified_gmt":"2022-11-29T08:09:26","slug":"%e3%80%90%e5%9b%bd%e9%99%85%e9%a1%b6%e4%bc%9a%e6%97%b6%e9%97%b4%e6%a3%80%e9%aa%8c%e5%a5%96%e8%a7%a3%e8%af%bb%e3%80%91%e6%9c%ba%e5%99%a8%e5%ad%a6%e4%b9%a0%e4%b8%ba%e4%bd%95%e9%9a%be%e4%bb%a5%e5%ba%94-2","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=5624","title":{"rendered":"\u3010\u56fd\u9645\u9876\u4f1a\u65f6\u95f4\u68c0\u9a8c\u5956\u89e3\u8bfb\u3011\u673a\u5668\u5b66\u4e60\u4e3a\u4f55\u96be\u4ee5\u5e94\u7528\u4e8e\u771f\u5b9e\u7684\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf\uff1f\uff08\u4e0b\uff09"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">\u7f16\u8005\u8350\u8bed\uff1a\u8be5\u8bba\u6587\u53d1\u8868\u4e8e\u5b89\u5168\u9876\u4f1aIEEE S&amp;P&#8217;10\uff0c\u4e8e\u5341\u5e74\u540e\u83b7\u65f6\u95f4\u68c0\u9a8c\u5956\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f5c\u8005\uff1a \u5218\u660e\u70dc\uff0c\u6bb5\u6d77\u65b0    \u6587\u7ae0\u6765\u6e90\u4e8eNISL\u5b9e\u9a8c\u5ba4 <\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"850\" height=\"295\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2022\/11\/1-3.png\" alt=\"\" class=\"wp-image-5625\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/1-3.png 850w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/1-3-300x104.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/1-3-768x267.png 768w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/1-3-150x52.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/1-3-250x87.png 250w\" sizes=\"auto, (max-width: 850px) 100vw, 850px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5168\u6587\u51714000\u5b57\uff0c\u9605\u8bfb\u65f6\u95f4\u7ea614\u5206\u949f\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>\u4f5c\u8005\u4ecb\u7ecd\uff1a\u5218\u660e\u70dc\uff0c\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u4e0e\u7cfb\u7edf\u5b89\u5168\u5b9e\u9a8c\u5ba4\u535a\u58eb\u7814\u7a76\u751f\uff0c\u7814\u7a76\u65b9\u5411\u4e3a\u7f51\u7edc\u5b89\u5168\u548c\u4eba\u5de5\u667a\u80fd\u5b89\u5168\uff0c\u5bfc\u5e08\u4e3a\u6bb5\u6d77\u65b0\u6559\u6388\u3002\u535a\u58eb\u671f\u95f4\u5728\u57df\u540d\u57fa\u7840\u8bbe\u65bd\u5b89\u5168\u3001\u6076\u610f\u52a0\u5bc6\u6d41\u91cf\u68c0\u6d4b\u4ee5\u53ca\u4eba\u5de5\u667a\u80fd\u6a21\u578b\u5bf9\u6297\u5206\u6790\u7b49\u9886\u57df\u53d1\u8868\u9ad8\u6c34\u5e73\u671f\u520a\u4f1a\u8bae\u8bba\u6587\u5341\u4f59\u7bc7\uff08\u5305\u62ecACM CCS\u3001TDSC\u3001IJCAI\u3001RAID\u3001ACSAC\u3001ESORIC\uff09\uff0c\u83b7\u5f972022\u5e74\u5ea6 EthiCS \u6700\u4f73\u5b66\u751f\u8bba\u6587\u5956\u30012021\u5e74\u201c\u7b2c\u4e94\u5c4a\u5f3a\u7f51\u676f\u667a\u80fd\u5bc6\u7801\u7834\u89e3\u8d5b\u9053\u4e00\u7b49\u5956\u201d\u3002\u9884\u8ba1\u6bd5\u4e1a\u65f6\u95f42023\u5e746\u6708\uff0c\u8054\u7cfb\u90ae\u7bb1liumx18@mails.tsinghua.edu.cn\u3002<\/em><\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-text-color has-vivid-cyan-blue-color wp-block-paragraph\"><strong>01<\/strong><\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-text-color has-vivid-cyan-blue-color wp-block-paragraph\"><strong>\u3010\u5165\u4fb5\u68c0\u6d4b\u4e2d\u5e94\u7528\u673a\u5668\u5b66\u4e60\u7684\u5efa\u8bae\u3011<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u672c\u6587\u4f5c\u8005\u8ba4\u4e3a\uff0c\u5c3d\u7ba1\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u5728\u4e00\u4e9b\u7ecf\u5178\u5206\u7c7b\u4efb\u52a1\u4e0a\u53d6\u5f97\u4e86\u4f18\u5f02\u7684\u6210\u7ee9\uff0c\u4f46\u7531\u4e8e\u7f51\u7edc\u5b89\u5168\u5165\u4fb5\u68c0\u6d4b\u573a\u666f\u7684\u7279\u6b8a\u6027\uff0c\u76f2\u76ee\u5730\u5728\u771f\u5b9e\u5b89\u5168\u573a\u666f\u4e2d\u7167\u642c\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u53ef\u80fd\u96be\u4ee5\u53d6\u5f97\u826f\u597d\u7684\u6548\u679c\u3002\u540c\u65f6\uff0c\u672c\u6587\u8ba4\u4e3a\uff0c\u5b89\u5168\u4eba\u5458\u4e0d\u5e94\u76f2\u76ee\u8ffd\u6c42\u201c\u6570\u636e\u96c6\u4e0a\u6548\u679c\u66f4\u597d\u201d\u7684\u68c0\u6d4b\u7ed3\u679c\uff08\u5982\u51c6\u786e\u7387\u66f4\u9ad8\uff09\uff0c\u800c\u5e94\u8be5\u66f4\u597d\u5730\u7406\u89e3\u5165\u4fb5\u68c0\u6d4b\u4efb\u52a1\u7684\u672c\u8d28\u3002\u4f8b\u5982\u4ec5\u5728DARPA\u6570\u636e\u96c6\u4e0a\u5c1d\u8bd5\u67d0\u79cd\u673a\u5668\u5b66\u4e60\u65b9\u6848\uff0c\u5e76\u4e0d\u80fd\u7ed9\u771f\u5b9e\u73af\u5883\u7684\u5165\u4fb5\u68c0\u6d4b\u5e26\u6765\u5e2e\u52a9\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e3a\u6b64\uff0c\u4f5c\u8005\u6839\u636e\u5176\u5728\u5165\u4fb5\u68c0\u6d4b\u9886\u57df\u591a\u5e74\u7684\u7ecf\u9a8c\u63d0\u51fa\u4e86\u4e00\u7cfb\u5217\u5e94\u5bf9\u6311\u6218\u7684\u5efa\u8bae\uff0c\u4e3b\u8981\u5305\u62ec<strong>\u95ee\u9898\u5b9a\u4e49<\/strong>\uff08\u4f7f\u7528\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u524d\uff09\u548c<strong>\u65b9\u6cd5\u8bc4\u4f30<\/strong>\uff08\u4f7f\u7528\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u540e\uff09\u4e24\u65b9\u9762\uff0c\u4f9b\u7814\u7a76\u4eba\u5458\u53c2\u8003\u3002\u867d\u7136\u672c\u6587\u4e3b\u9898\u4e3a\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\uff0c\u5176\u6240\u63d0\u51fa\u7684\u5efa\u8bae\u5177\u6709\u5f88\u5f3a\u7684\u901a\u7528\u4ef7\u503c\uff0c\u4e5f\u503c\u5f97\u5176\u4ed6\u673a\u5668\u5b66\u4e60\u5b89\u5168\u5e94\u7528\u573a\u666f\u53c2\u8003\u501f\u9274\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6b64\u5916\uff0cDaniel Arp \u7b49\u4eba\u5728 USENIX Security &#8217;22 \u53d1\u8868\u7684\u8bba\u6587 [4] \u5bf9\u672c\u6587\u8fdb\u884c\u4e86\u6269\u5c55\uff0c\u5206\u6790\u4e86\u673a\u5668\u5b66\u4e60\u5e94\u7528\u4e8e\u5b89\u5168\u573a\u666f\u4e2d\u7684\u6d41\u7a0b\uff0c\u5982\u56fe1\u6240\u793a\uff0c\u4e3b\u8981\u5bf9\u65b9\u6cd5\u8bbe\u8ba1\uff08\u5373\u4f7f\u7528\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\uff09\u8fdb\u884c\u5efa\u6a21\uff0c\u5e76\u5bf9\u5404\u6b65\u9aa4\u7ed9\u51fa\u8be6\u7ec6\u5efa\u8bae\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"174\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2022\/11\/2-5-1024x174.png\" alt=\"\" class=\"wp-image-5626\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/2-5-1024x174.png 1024w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/2-5-300x51.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/2-5-768x131.png 768w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/2-5-150x26.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/2-5-250x43.png 250w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/2-5.png 1080w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-align:center\">\u56fe1\uff1a\u673a\u5668\u5b66\u4e60\u5e94\u7528\u4e8e\u5b89\u5168\u573a\u666f\u7684\u5171\u6027\u95ee\u9898<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u68b3\u7406\u4e86\u4e0a\u8ff0\u4e24\u7bc7\u5b66\u672f\u8bba\u6587\u7684\u5185\u5bb9\uff0c\u56f4\u7ed5\u5982\u4f55\u5728\u5b89\u5168\u68c0\u6d4b\u573a\u666f\u4e0b\u66f4\u597d\u5730\u5e94\u7528\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\uff0c\u603b\u7ed3\u51fa\u5982\u4e0b\u5efa\u8bae\uff1a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. \u95ee\u9898\u5b9a\u4e49\u90e8\u5206<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>a. \u6df1\u5165\u7406\u89e3\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf\u7684\u5b89\u5168\u5a01\u80c1\u6a21\u578b<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u5b89\u5168\u68c0\u6d4b\u573a\u666f\u4e2d\u76f2\u76ee\u5730\u4f7f\u7528\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u96be\u4ee5\u53d6\u5f97\u9884\u671f\u7684\u6548\u679c\uff0c\u7814\u7a76\u4eba\u5458\u5e94\u8be5\u63d0\u524d\u660e\u786e\u9884\u671f\u7684\u5b89\u5168\u5a01\u80c1\u6a21\u578b\uff0c\u5176\u4e2d\u5305\u62ec\u8bc4\u4f30\u68c0\u6d4b\u7cfb\u7edf\u7684\u7f51\u7edc\u73af\u5883\u590d\u6742\u7a0b\u5ea6\u3001\u653b\u51fb\u8005\u653b\u51fb\u624b\u6bb5\u3001\u7cfb\u7edf\u8bef\u5224\u4ee5\u53ca\u653b\u51fb\u9003\u9038\u5bf9\u76ee\u6807\u7f51\u7edc\u73af\u5883\u9020\u6210\u7684\u6f5c\u5728\u5f71\u54cd\u7b49\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>b.\u7f29\u5c0f\u8303\u56f4\uff0c\u805a\u7126\u5b89\u5168\u68c0\u6d4b\u7cfb\u7edf\u6240\u89e3\u51b3\u7684\u653b\u51fb\u7c7b\u578b<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e3a\u66f4\u597d\u5730\u4f7f\u68c0\u6d4b\u65b9\u6cd5\u4e0e\u68c0\u6d4b\u4efb\u52a1\u76f8\u5339\u914d\uff0c\u7814\u7a76\u4eba\u5458\u5e94\u9996\u5148\u660e\u786e\u5e76\u754c\u5b9a\u68c0\u6d4b\u7684\u76ee\u6807\u653b\u51fb\u7c7b\u578b\u3002\u68c0\u6d4b\u76ee\u6807\u5212\u5b9a\u5f97\u8d8a\u5177\u4f53\uff0c\u8d8a\u6709\u52a9\u4e8e\u63d0\u5347\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u7684\u6027\u80fd\uff0c\u5e76\u964d\u4f4e\u51fa\u9519\u7684\u53ef\u80fd\u6027\u3002Kruegel \u7b49\u4eba\u5173\u4e8e Web \u653b\u51fb\u68c0\u6d4b\u7684\u5de5\u4f5c\u5c31\u662f\u5f02\u5e38\u68c0\u6d4b\u7684\u8303\u4f8b [5]\uff1a\u68c0\u6d4b\u5e26\u6709\u7578\u5f62\u67e5\u8be2\u53c2\u6570\u7684Web\u653b\u51fb\u3002\u5176\u6b21\uff0c\u7814\u7a76\u4eba\u5458\u5728\u9488\u5bf9\u7279\u5b9a\u4efb\u52a1\u573a\u666f\u9009\u62e9\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u65f6\uff0c\u5e94\u8be5\u6df1\u5165\u7406\u89e3\u5f53\u524d\u68c0\u6d4b\u573a\u666f\u7684\u76ee\u6807\uff0c\u5e76\u7406\u89e3\u7b97\u6cd5\u8868\u73b0\u826f\u597d\u7684\u6839\u672c\u539f\u56e0\uff0c\u800c\u4e0d\u662f\u5148\u9884\u8bbe\u4f7f\u7528\uff08\u7279\u5b9a\uff09\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\uff0c\u518d\u9009\u53d6\u67d0\u4e00\u4efb\u52a1\u573a\u666f\u8fdb\u884c\u5e94\u7528\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. \u65b9\u6cd5\u8bbe\u8ba1\u548c\u5b9e\u73b0\u90e8\u5206<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>a.\u9002\u5f53\u7684\u6570\u636e\u6536\u96c6\u548c\u51c6\u786e\u7684\u6807\u6ce8<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>\u9488\u5bf9\u5177\u4f53\u7684\u68c0\u6d4b\u4efb\u52a1\uff0c\u9009\u62e9\u5408\u9002\u7684\u6570\u636e\u96c6\u3002<\/strong>\u5b89\u5168\u7814\u7a76\u8005\u5e94\u9009\u62e9\u7b26\u5408\u771f\u5b9e\u6570\u636e\u5206\u5e03\u7684\u6570\u636e\u96c6\u7528\u4e8e\u8bad\u7ec3\u3002\u82e5\u8bad\u7ec3\u6837\u672c\u6570\u636e\u4e0e\u771f\u5b9e\u6570\u636e\u504f\u5dee\u8fc7\u5927\uff0c\u68c0\u6d4b\u7cfb\u7edf\u5c06\u65e0\u6cd5\u5f97\u5230\u53ef\u4fe1\u7ed3\u8bba\u3002\u5982\u679c\u9700\u8981\u4eba\u4e3a\u6784\u9020\u6570\u636e\u96c6\uff0c\u5e94\u4f7f\u6784\u9020\u7684\u6570\u636e\u5c3d\u53ef\u80fd\u5730\u8986\u76d6\u591a\u79cd\u7c7b\u578b\u7684\u771f\u5b9e\u6570\u636e\u3002\u4f8b\u5982\uff0c\u5728\u4f7f\u7528\u6c99\u7bb1\u751f\u6210\u6837\u672c\u6d41\u91cf\u65f6\uff0c\u9700\u8981\u8003\u8651\u6837\u672c\u7c7b\u578b\u7684\u9488\u5bf9\u6027\u3001\u591a\u6837\u6027\uff0c\u5e76\u8ba8\u8bba\u6c99\u7bb1\u73af\u5883\u672c\u8eab\u5bf9\u6d41\u91cf\u751f\u6210\u7684\u9650\u5236\u53ca\u5176\u5bf9\u6d41\u91cf\u5206\u6790\u5e26\u6765\u7684\u5f71\u54cd\u3002<\/li><li><strong>\u68c0\u9a8c\u6570\u636e\u6807\u7b7e\u7684\u51c6\u786e\u6027\u3002<\/strong>\u7531\u4e8e\u591a\u6570\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u7684\u672c\u8d28\u4efb\u52a1\u662f\u5206\u7c7b\uff0c\u5176\u51c6\u786e\u6027\u5c06\u4e25\u91cd\u4f9d\u8d56\u4e8e\u6807\u7b7e\u6570\u636e\u7684\u51c6\u786e\u6027\u3002\u56e0\u6b64\uff0c\u7814\u7a76\u4eba\u5458\u5e94\u8be5\u5c3d\u53ef\u80fd\u63d0\u524d\u9a8c\u8bc1\u6807\u7b7e\u6570\u636e\u96c6\u7684\u51c6\u786e\u6027\uff0c\u8fc7\u6ee4\u5e26\u6709\u9519\u8bef\u6807\u7b7e\u7684\u6570\u636e\u3002<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>b.\u7cfb\u7edf\u8bbe\u8ba1\u548c\u8bad\u7ec3<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u9009\u62e9\u53ef\u89e3\u91ca\u7684\u7279\u5f81\uff0c\u907f\u514d\u9519\u8bef\u7684\u6a21\u578b\u68c0\u6d4b\u56e0\u679c\u5173\u7cfb\u3002<\/strong>\u7814\u7a76\u4eba\u5458\u9700\u8981\u5206\u6790\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u201c\u5b66\u5230\u201d\u7684\u5177\u4f53\u7279\u5f81\u5728\u5b89\u5168\u5c42\u9762\u662f\u5426\u53ef\u89e3\u91ca\u3002\u4f8b\u5982\uff0c\u5728\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u516c\u5f00\u6570\u636e\u96c6\u4e2d\uff0c\u653b\u51fb\u53ef\u80fd\u4f1a\u6765\u81ea\u67d0\u4e2a\u7279\u5b9a\u7684\u7f51\u6bb5\u3002\u56e0\u6b64\uff0c\u673a\u5668\u5b66\u4e60\u6a21\u578b\u53ef\u80fd\u4f1a\u5c06\u7279\u5b9aIP\u5730\u5740\u8303\u56f4\u4f5c\u4e3a\u7279\u5f81\u8fdb\u884c\u5206\u7c7b\uff0c\u800c\u5e76\u672a\u771f\u6b63\u4ece\u6d41\u91cf\u5c42\u9762\u5b66\u4e60\u5230\u653b\u51fb\u7684\u6a21\u5f0f\u3002\u8fd9\u5c06\u5bfc\u81f4\u6a21\u578b\u4ea7\u751f\u9519\u8bef\u7684\u5206\u7c7b\u63a8\u65ad\u903b\u8f91\uff0c\u5f15\u53d1\u8bef\u62a5\u6216\u8005\u6f0f\u62a5\u3002\u56e0\u6b64\uff0c\u7814\u7a76\u4eba\u5458\u5e94\u8be5\u6839\u636e\u7279\u5b9a\u7684\u4efb\u52a1\u573a\u666f\uff0c\u9009\u62e9\u53ef\u89e3\u91ca\u7684\u7279\u5f81\u6784\u5efa\u673a\u5668\u5b66\u4e60\u6a21\u578b\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. \u65b9\u6cd5\u8bc4\u4f30\u90e8\u5206<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>a. \u63d0\u524d\u8003\u8651\u7cfb\u7edf\u8bef\u5224\u5bf9\u76ee\u6807\u7f51\u7edc\u9020\u6210\u7684\u5f71\u54cd<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u964d\u4f4e\u5047\u9633\u6027\u5e94\u8be5\u4f5c\u4e3a\u5f02\u5e38\u68c0\u6d4b\u7cfb\u7edf\u7684\u7b2c\u4e00\u8981\u52a1\u3002\u5bf9\u6b64\uff0c\u9996\u5148\u9700\u8981\u7f29\u5c0f\u8303\u56f4\u3001\u805a\u7126\u68c0\u6d4b\u653b\u51fb\u7684\u7c7b\u578b\uff1b\u5176\u6b21\uff0c\u7814\u7a76\u4eba\u5458\u9700\u8003\u8651\u68c0\u6d4b\u6f0f\u62a5\u53ca\u8bef\u62a5\u7684\u5904\u7406\u65b9\u6848\uff0c\u4f8b\u5982\u57fa\u4e8e\u67d0\u79cd\u540e\u5904\u7406\uff08post-processing\uff09\u64cd\u4f5c\u6765\u51cf\u5c11\u5047\u9633\u6027 [6,7]\uff1b\u540c\u65f6\uff0c\u8003\u8651\u5230\u7f51\u7edc\u6d41\u91cf\u5728\u81ea\u7136\u60c5\u51b5\u4e0b\u5373\u53ef\u8868\u73b0\u51fa\u591a\u6837\u6027\uff08\u5982\u77ed\u65f6\u95f4\u5185\u7684\u6d41\u91cf\u6296\u52a8\u7b49\uff09\uff0c\u4e3a\u907f\u514d\u6a21\u578b\u4ea7\u751f\u8bef\u5224\uff0c\u53ef\u9884\u5148\u5236\u5b9a\u9002\u5e94\u7f51\u7edc\u6d41\u91cf\u81ea\u7136\u591a\u6837\u6027\u7684\u7b56\u7565\uff08\u4f8b\u5982\u5bf9\u67d0\u4e2a\u65f6\u95f4\u95f4\u9694\u5185\u7684\u6d41\u91cf\u53d6\u5e73\u5747\u503c\u8fdb\u884c\u5e73\u6ed1\u5904\u7406\uff09\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>b.\u57fa\u4e8e\u5bf9\u68c0\u6d4b\u95ee\u9898\u7684\u6df1\u5165\u7406\u89e3\uff0c\u8bbe\u8ba1\u5145\u5206\u7684\u8bc4\u4ef7\u6307\u6807\u5408\u7406\u8bc4\u4f30\u7cfb\u7edf\u8868\u73b0<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5177\u4f53\u5305\u62ec\uff1a1\uff09\u9009\u53d6\u9002\u5f53\u7684\u8bc4\u4f30\u6570\u636e\u96c6\uff0c\u5c3d\u53ef\u80fd\u4f7f\u7528\u771f\u5b9e\u6570\u636e\u96c6\u5e76\u6db5\u76d6\u591a\u79cd\u89c4\u6a21\u3001\u7c7b\u578b\u7684\u7f51\u7edc\uff1b2\uff09\u9009\u53d6\u9002\u5f53\u7684\u8bc4\u4f30\u53c2\u6570\uff0c\u4ec5\u51ed\u51c6\u786e\u7387\u65e0\u6cd5\u4f53\u73b0\u68c0\u6d4b\u7cfb\u7edf\u7684\u6574\u4f53\u6027\u80fd\uff1b3\uff09\u89e3\u91ca\u5404\u7c7b\u68c0\u6d4b\u7ed3\u679c\uff0c\u4f8b\u5982\u901a\u8fc7\u968f\u673a\u91c7\u6837\u5bf9\u5047\u9633\u6027\u7ed3\u679c\u8fdb\u884c\u4eba\u5de5\u5206\u6790\u5e76\u52a0\u4ee5\u89e3\u91ca\uff1b4\uff09\u8003\u8651\u7cfb\u7edf\u7684\u5b9e\u7528\u6027\uff0c\u4f8b\u5982\u80fd\u5426\u6ee1\u8db3\u5b9e\u65f6\u68c0\u6d4b\u7684\u6027\u80fd\u8981\u6c42\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>c.\u771f\u5b9e\u573a\u666f\u4e2d\u7684\u90e8\u7f72\u8bc4\u4f30\u662f\u5fc5\u9700\u7684<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf\u7684\u5b9e\u7528\u6027\u975e\u5e38\u91cd\u8981\uff0c\u4ec5\u51ed\u5b9e\u9a8c\u5ba4\u6570\u636e\u548c\u7ed3\u679c\u65e0\u6cd5\u5bf9\u5176\u8fdb\u884c\u5168\u9762\u8bc4\u4f30\uff0c\u9700\u8981\u5728\u771f\u5b9e\u7f51\u7edc\u73af\u5883\u4e2d\u8fdb\u884c\u90e8\u7f72\u548c\u9a8c\u8bc1\u3002<\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-text-color has-vivid-cyan-blue-color wp-block-paragraph\"><strong>02<\/strong><\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-text-color has-vivid-cyan-blue-color wp-block-paragraph\"><strong>\u3010\u5f71\u54cd&amp;\u73b0\u72b6\u3011<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u300aOutside\u300b\u4e00\u6587\u5728\u53d1\u8868\u540e\u6301\u7eed\u53d7\u5230\u7814\u7a76\u4eba\u5458\u7684\u5173\u6ce8\u548c\u8ba8\u8bba\uff0c\u76ee\u524d\u5f15\u7528\u91cf\u5df2\u8d85\u8fc71600\u6b21\uff08\u5982\u56fe2 Google Scholar\u6240\u793a\uff09\u3002\u8fc7\u53bb\u5341\u4f59\u5e74\u95f4\uff0c\u673a\u5668\u5b66\u4e60\u7684\u98de\u901f\u53d1\u5c55\u6709\u76ee\u5171\u7779\uff0c\u5df2\u7ecf\u88ab\u6108\u53d1\u5e7f\u6cdb\u5730\u5e94\u7528\u4e8e\u56fe\u50cf\u8bc6\u522b\u3001\u673a\u5668\u7ffb\u8bd1\u7b49\u5404\u7c7b\u4efb\u52a1\u4e4b\u4e2d\u3002\u5982\u4eca\uff0c\u5b89\u5168\u7814\u7a76\u4eba\u5458\u5728\u5e94\u7528\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u65f6\uff0c\u662f\u5426\u8fd8\u9762\u4e34\u4e0e\u300aOutside\u300b\u6587\u4e2d\u76f8\u540c\/\u4e0d\u540c\u7684\u6311\u6218\u548c\u56f0\u5883\uff1f\u800c\u300aOutside\u300b\u63d0\u51fa\u7684\u5efa\u8bae\uff0c\u53c8\u662f\u5426\u771f\u7684\u88ab\u7814\u7a76\u8005\u5e94\u7528\u3001\u8fbe\u5230\u4e86\u201c\u4e3a\u672a\u6765\u7814\u7a76\u63d0\u4f9b\u53c2\u8003\u201d\u7684\u671f\u671b\u5462\uff1f<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"719\" height=\"259\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2022\/11\/3-2.png\" alt=\"\" class=\"wp-image-5627\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/3-2.png 719w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/3-2-300x108.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/3-2-150x54.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/3-2-250x90.png 250w\" sizes=\"auto, (max-width: 719px) 100vw, 719px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-align:center\">\u56fe2\uff1a\u672c\u6587\u7684\u88ab\u5f15\u7528\u6b21\u6570\uff0c\u6765\u81ea\u8c37\u6b4c\u5b66\u672f<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Daniel Arp \u7b49\u4eba\u53d1\u8868\u4e8e USENIX Security &#8217;22 \u7684\u5de5\u4f5c[4]\u8c03\u7814\u4e86 30 \u7bc7\u53d1\u8868\u4e8e\u7f51\u7edc\u5b89\u5168\u56db\u5927\u9876\u7ea7\u4f1a\u8bae\u4e0a\u7684\u7814\u7a76\u8bba\u6587\uff0c\u5bf9\u5f53\u524d\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u5728\u5b89\u5168\u7814\u7a76\u4e2d\u7684\u5e94\u7528\u56f0\u5883\u8fdb\u884c\u5206\u6790\uff0c\u8fd9\u4e9b\u8bba\u6587\u7684\u4e3b\u9898\u5305\u62ec\uff1a\u6076\u610f\u8f6f\u4ef6\u68c0\u6d4b\u3001\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u3001\u6f0f\u6d1e\u53d1\u73b0\u3001\u7f51\u7ad9\u6307\u7eb9\u653b\u51fb\u3001\u793e\u4ea4\u7f51\u7edc\u6ee5\u7528\u3001\u4e8c\u8fdb\u5236\u4ee3\u7801\u5206\u6790\u3001\u4ee3\u7801\u5f52\u56e0\u5206\u6790\u3001\u9690\u5199\u3001\u5728\u7ebf\u8bc8\u9a97\u3001\u6e38\u620f\u673a\u5668\u4eba\u548c\u5e7f\u544a\u963b\u65ad\u3002\u5de5\u4f5c[4]\u7684\u7ed3\u679c\u8868\u660e\uff0c\u76f4\u5230\u4eca\u5929\uff0c\u673a\u5668\u5b66\u4e60\u5728\u5b89\u5168\u9886\u57df\u7684\u5e94\u7528\u4ecd\u7136\u666e\u904d\u9762\u4e34\u8bf8\u591a\u6311\u6218\uff0c\u5982\u56fe3\u6240\u793a\u3002\u9664\u300aOutside\u300b\u4e2d\u63d0\u5230\u7684\u8bef\u62a5\u5f15\u5165\u7684\u9ad8\u4ee3\u4ef7\u4ee5\u53ca\u96be\u4ee5\u5bf9\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u8fdb\u884c\u51c6\u786e\u5168\u9762\u8bc4\u4f30\u7684\u6311\u6218\u5916\uff0cDaniel Arp \u8fd8\u53d1\u73b0\uff0c\u5df2\u6709\u5de5\u4f5c\u5728\u6536\u96c6\u53ef\u4fe1\u7684\u6570\u636e\u65b9\u9762\u4e5f\u9762\u4e34\u4e00\u5b9a\u7684\u6311\u6218\uff0c\u4f8b\u5982\u6570\u636e\u96c6\u504f\u5dee\u3001\u96be\u4ee5\u4f53\u73b0\u771f\u5b9e\u573a\u666f\u7684\u6570\u636e\u60c5\u51b5\u4ee5\u53ca\u7f3a\u4e4f\u9ad8\u8d28\u91cf\u7684\u6807\u6ce8\u6570\u636e\u7b49\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"406\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2022\/11\/4-2-1024x406.png\" alt=\"\" class=\"wp-image-5628\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/4-2-1024x406.png 1024w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/4-2-300x119.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/4-2-768x304.png 768w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/4-2-150x59.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/4-2-250x99.png 250w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/4-2.png 1080w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-align:center\">\u56fe3\uff1a30\u7bc7\u8bba\u6587\u4e2d\uff0c10\u4e2a\u5171\u6027\u7f3a\u9677\u7684\u5206\u5e03\u60c5\u51b5 [4]<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6b64\u5916\uff0c\u4e3a\u4e86\u89e3\u300aOutside\u300b\u6587\u4e2d\u5efa\u8bae\u5bf9\u540e\u7eed\u5b89\u5168\u7814\u7a76\u7684\u5f71\u54cd\uff0c\u6211\u4eec\u5728\u7f51\u7edc\u5b89\u5168\u56db\u5927\u9876\u7ea7\u5b66\u672f\u4f1a\u8bae\u4e0a\u68c0\u7d22\u4e86\u6240\u6709\u5f15\u7528\u8be5\u8bba\u6587\u7684\u5de5\u4f5c\uff0c\u603b\u5171\u5305\u542b 20 \u7bc7\u8bba\u6587\uff0c\u6d89\u53ca\uff1a\u6d41\u91cf\u68c0\u6d4b [9~13]\u3001\u57fa\u7840\u8bbe\u65bd\u653b\u51fb [14]\u3001\u6076\u610f\u767b\u5f55\u8ba4\u8bc1\u68c0\u6d4b [15~17]\u3001\u6076\u610f\u8f6f\u4ef6\u68c0\u6d4b [18~19]\u3001\u673a\u5668\u5b66\u4e60\u7684\u6f0f\u6d1e [20~21]\u3001\u7efc\u8ff0\u5206\u6790\u5de5\u4f5c [4, 22~24]\u3001\u5a01\u80c1\u60c5\u62a5\u5206\u6790 [25~26]\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u4eec\u5206\u6790\u4e86\u5df2\u6709\u5de5\u4f5c\u5f15\u7528\u3001\u501f\u9274\u300aOutside\u300b\u4e00\u6587\u7684\u5177\u4f53\u60c5\u51b5\u3002\u5982\u88681\u6240\u793a\uff0c\u4ec5\u6709 5 \/20\u7bc7\u8bba\u6587\u201c\u771f\u6b63\u5730\u53c2\u8003\u201d\u4e86\u672c\u6587\u7684\u5efa\u8bae\uff0c\u5373\u5728\u65b9\u6cd5\u8bbe\u8ba1\u548c\u8bc4\u4f30\u4e0a\u90fd\u8fdb\u884c\u4e86\u9488\u5bf9\u6027\u7684\u6539\u8fdb [9, 14, 16, 18, 19]\uff1b4\/20 \u7bc7\u7efc\u8ff0\u7c7b\u8bba\u6587\u5bf9\u672c\u6587\u8fdb\u884c\u4e86\u4e00\u5b9a\u7684\u6269\u5c55\u5206\u6790\uff0c\u5982 Daniel Arp \u7684\u5de5\u4f5c [4]\uff1b\u6b64\u5916\uff0c3 \/20\u7bc7\u8bba\u6587\u4ec5\u5c06\u672c\u6587\u4f5c\u4e3a\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u9886\u57df\u7efc\u8ff0\u8fdb\u884c\u5f15\u7528\uff0c\u800c\u5e76\u975e\u5c06\u5176\u4f5c\u4e3a\u5e94\u7528\u673a\u5668\u5b66\u4e60\u7684\u53c2\u7167\uff1b\u5176\u4f598 \/20\u7bc7\u8bba\u6587\u4ec5\u63d0\u5230\u4e86\u672c\u6587\u63d0\u51fa\u7684\u95ee\u9898\uff0c\u4f46\u5e76\u672a\u660e\u786e\u5730\u5728\u65b9\u6cd5\u8bbe\u8ba1\u3001\u8bc4\u4f30\u65b9\u9762\u8fdb\u884c\u6539\u8fdb\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"321\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2022\/11\/5-2-1024x321.png\" alt=\"\" class=\"wp-image-5629\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/5-2.png 1024w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/5-2-300x94.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/5-2-768x241.png 768w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/5-2-150x47.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/5-2-250x78.png 250w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-align:center\">\u88681\uff1a\u5bf9\u672c\u6587\u7684\u5f15\u7528\u60c5\u51b5\u603b\u7ed3<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7ed3\u5408\u672c\u6587\u3001Daniel&nbsp;Arp&nbsp;\u7b49\u4eba\u7684\u7814\u7a76\u7ed3\u679c\u4ee5\u53ca\u6211\u4eec\u8c03\u7814\u7684\u7ed3\u679c\uff0c\u6211\u4eec\u8ba4\u4e3a\uff0c\u65f6\u81f3\u4eca\u65e5\uff0c<strong>\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u5e94\u7528\u4e8e\u5b89\u5168\u9886\u57df\u4ecd\u7136\u9762\u4e34\u8bf8\u591a\u6311\u6218<\/strong>\uff0c\u5305\u62ec\u7f51\u7edc\u5b89\u5168\u573a\u666f\u4e2d\u7684\u8bef\u5224\u4ee3\u4ef7\u6781\u9ad8\uff08High Cost of Errors\uff09\u3001\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u4e0e\u5b89\u5168\u6807\u51c6\u7684\u8bed\u4e49\u5dee\u5f02\uff08Semanctic Gap\uff09\u3001\u73b0\u5b9e\u7f51\u7edc\u6d41\u91cf\u7684\u590d\u6742\u6027\uff08Diversity of Network Traffic\uff09\u5bfc\u81f4\u5f02\u5e38\u96be\u4ee5\u5224\u65ad\u3001\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u5728\u5b89\u5168\u68c0\u6d4b\u573a\u666f\u7684\u5b9e\u9645\u6548\u679c\u5f88\u96be\u5f97\u5230\u5168\u9762\u51c6\u786e\u7684\u8bc4\u4f30\uff08Difficulties with Evaluation\uff09\u7b49\u3002<strong>\u8fd9\u5e76\u975e\u5ba3\u544a\u4e86\u673a\u5668\u5b66\u4e60\u5de5\u5177\u4e0d\u9002\u5408\u5728\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u751a\u81f3\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u4e2d\u4f7f\u7528\uff0c\u800c\u662f\u63d0\u9192\u3001\u6307\u5f15\u7814\u7a76\u4eba\u5458\u76f4\u9762\u6311\u6218\u3001\u5e94\u5bf9\u6311\u6218\uff0c\u4f7f\u673a\u5668\u5b66\u4e60\u5de5\u5177\u5728\u5b89\u5168\u7814\u7a76\u4e2d\u66f4\u597d\u5730\u53d1\u6325\u4f5c\u7528\u3002<\/strong><\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-text-color has-vivid-cyan-blue-color wp-block-paragraph\"><strong>03<\/strong><\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-text-color has-vivid-cyan-blue-color wp-block-paragraph\"><strong>\u3010\u603b\u7ed3\u3011<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u672c\u6587\u9996\u6b21\u7cfb\u7edf\u5730\u7814\u7a76\u4e86\u673a\u5668\u5b66\u4e60\u5e94\u7528\u4e8e\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u4e2d\u7684\u6311\u6218\uff0c\u5305\u62ec\uff1a1\uff09\u7f51\u7edc\u5b89\u5168\u573a\u666f\u4e2d\u7684\u5165\u4fb5\u68c0\u6d4b\u4e0e\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u7684\u79bb\u7fa4\u70b9\u68c0\u6d4b\u5177\u6709\u672c\u8d28\u5dee\u5f02\uff08Outlier Detection\uff09\uff1b2\uff09\u7f51\u7edc\u5b89\u5168\u573a\u666f\u4e2d\u7684\u8bef\u5224\u53ef\u80fd\u4f1a\u5f15\u5165\u6781\u9ad8\u4ee3\u4ef7\uff08High Cost of Errors\uff09\uff1b3\uff09\u673a\u5668\u5b66\u4e60\u7b97\u6cd5\u4e0e\u5b89\u5168\u8fd0\u7ef4\u7684\u8bed\u4e49\u5dee\u5f02\uff08Semanctic Gap\uff09\uff1b4\uff09\u73b0\u5b9e\u7f51\u7edc\u6d41\u91cf\u590d\u6742\u591a\u53d8\uff0c\u96be\u4ee5\u51c6\u786e\u754c\u5b9a\u4f55\u4e3a\u5f02\u5e38\uff08Diversity of Network Traffic\uff09\uff1b5\uff09\u5f02\u5e38\u68c0\u6d4b\u7cfb\u7edf\u7684\u7ed3\u679c\u96be\u4ee5\u8bc4\u4f30\uff08Difficulties with Evaluation\uff09\u3002\u4e3a\u4e86\u514b\u670d\u8fd9\u4e9b\u6311\u6218\uff0c\u672c\u6587\u5728\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u9886\u57df\u5e94\u7528\u673a\u5668\u5b66\u4e60\u7684\u65b9\u6cd5\u63d0\u4f9b\u4e86\u4e00\u7cfb\u5217\u7684\u6307\u5bfc\u539f\u5219\u3002\u6700\u91cd\u8981\u7684\u662f\u4e0d\u5e94\u8be5\u76f2\u76ee\u4f7f\u7528\u673a\u5668\u5b66\u4e60\u5de5\u5177\uff0c\u800c\u5e94\u8be5\u66f4\u6df1\u5165\u5730\u7406\u89e3\u68c0\u6d4b\u7cfb\u7edf\u7684\u76ee\u6807\u3001\u80fd\u529b\u548c\u9650\u5236\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6b63\u5982\u300aOutside\u300b[0]\u548c\u5de5\u4f5c[4]\u7684\u4f5c\u8005\u6240\u8a00\uff0c\u6211\u4eec\u6bcf\u5929\u90fd\u80fd\u770b\u5230\u673a\u5668\u5b66\u4e60\uff08\u6216\u4eba\u5de5\u667a\u80fd\uff09\u5728\u67d0\u4e9b\u9886\u57df\u6210\u529f\u7684\u6545\u4e8b\u3002\u4f5c\u4e3a\u5b89\u5168\u7814\u7a76\u4eba\u5458\uff0c\u6211\u4eec\u80fd\u591f\u770b\u5230\u7684\u7528\u673a\u5668\u5b66\u4e60\u65b9\u6cd5\u8fdb\u884c\u5f02\u5e38\u68c0\u6d4b\u7684\u5b66\u672f\u8bba\u6587\u4e5f\u53ef\u4ee5\u8bf4\u6c57\u725b\u5145\u680b\u4e86\uff08\u5982\u679c\u6253\u5370\u51fa\u6765\u7684\u8bdd\uff09\u3002\u7136\u800c\uff0c\u5b9e\u9645\u90e8\u7f72\u5728\u751f\u4ea7\u7f51\u7edc\u4e2d\u53ef\u8fd0\u7ef4\u7684\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u4ea7\u54c1\u5374\u975e\u5e38\u5c11\u89c1\u3002\u6211\u4eec\u8ba4\u540c[0][4]\u8bba\u6587\u4e2d\u7684\u89c2\u70b9\uff0c\u5373\u7f51\u7edc\u5165\u4fb5\u68c0\u6d4b\u9886\u57df\u4e0e\u5176\u4ed6\u9886\u57df\u76f8\u6bd4\u5b58\u5728\u7740\u8bb8\u591a\u6311\u6218\uff0c\u5728\u5e94\u7528\u673a\u5668\u5b66\u4e60\u65b9\u6cd5\u65f6\u5b58\u5728\u8bb8\u591a\u8bef\u533a\uff0c\u5bfc\u81f4\u5f53\u524d\u8fd9\u4e9b\u65b9\u6cd5\u5728\u73b0\u5b9e\u5b89\u5168\u573a\u666f\u4e2d\u5e94\u7528\u6548\u679c\u4e0d\u597d\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u300aOutside\u300b\u4e00\u6587\u63d0\u51fa\u7684\u6311\u6218\u548c\u5efa\u8bae\u7ecf\u53d7\u4e86\u201c\u65f6\u95f4\u68c0\u9a8c\u201d\uff0c\u5728\u5341\u4f59\u5e74\u540e\u7684\u4eca\u5929\u4ecd\u5177\u6709\u91cd\u8981\u7684\u6307\u5bfc\u610f\u4e49\u3002\u6211\u4eec\u5e0c\u671b\u901a\u8fc7\u5206\u4eab\u672c\u6587\u7684\u4e3b\u8981\u89c2\u70b9\uff0c\u5f15\u8d77\u7814\u7a76\u8005\u5bf9\u673a\u5668\u5b66\u4e60\u5e94\u7528\u4e8e\u5b89\u5168\u573a\u666f\u65f6\u6240\u9762\u4e34\u6311\u6218\u7684\u5173\u6ce8\u3002\u6211\u4eec\u4e5f\u671f\u5f85\u4e0e\u611f\u5174\u8da3\u7684\u7814\u7a76\u4eba\u5458\u5171\u540c\u63a2\u8ba8\uff0c\u5982\u4f55\u66f4\u597d\u5730\u5c06\u673a\u5668\u5b66\u4e60\u5e94\u7528\u4e8e\u5b89\u5168\u573a\u666f\u4e4b\u4e2d\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"899\" height=\"527\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2022\/11\/6.png\" alt=\"\" class=\"wp-image-5630\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/6.png 899w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/6-300x176.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/6-768x450.png 768w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/6-150x88.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2022\/11\/6-250x147.png 250w\" sizes=\"auto, (max-width: 899px) 100vw, 899px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-align:center\">\u56fe4\uff1a\u8bba\u6587[0]\u603b\u7ed3<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u539f\u6587\u94fe\u63a5\uff1a<a href=\"https:\/\/ieeexplore.ieee.org\/document\/5504793\">https:\/\/ieeexplore.ieee.org\/document\/5504793<\/a><br>\u539f\u4f5c\u8005\u00a0PPT \u94fe\u63a5\uff1a<a href=\"http:\/\/oakland31.cs.virginia.edu\/slides\/anomaly-oakland.pdf\">http:\/\/oakland31.cs.virginia.edu\/slides\/anomaly-oakland.pdf<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u53c2\u8003\u6587\u732e<\/strong><br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[0] Sommer, R. &amp; Paxson, V. Outside the Closed World: On Using Machine Learning For Network Intrusion Detection. IEEE Symposium on Security and Privacy , 2010<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[1] Personal Page of Robin Sommer, https:\/\/www.icir.org\/robin\/<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[2] Personal Page of Vern Paxson, https:\/\/www.icir.org\/vern\/<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[3] Paxson, Vern. &#8220;Bro: a system for detecting network intruders in real-time.&#8221; Computer networks 31.23-24 (1999): 2435-2463.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[4] Arp, Daniel, et al. &#8220;Dos and don\u2019ts of machine learning in computer security.&#8221; Proc. of the USENIX Security Symposium. 2022.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[5] C. Kruegel and G. Vigna, \u201cAnomaly Detection of Web-based Attacks,\u201d inProc. ACM Conference on Computer andCommunications Security, 2003.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[6] G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee,\u201cBotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation,\u201d inProc. USENIX Security Sym-posium, August 2007.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[7] K. G. Anagnostakis, S. Sidiroglou, P. Akritidis, K. Xinidis,E. Markatos, and A. D. Keromytis, \u201cDetecting Targeted Attacks Using Shadow Honeypots,\u201d inProc. USENIX SecuritySymposium, 2005.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[8] Smutz, Charles, and Angelos Stavrou. &#8220;When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors.&#8221; NDSS. 2016.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[9] Fu, Chuanpu, et al. &#8220;Realtime robust malicious traffic detection via frequency domain analysis.&#8221; Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[10] Dyer, Kevin P., et al. &#8220;Protocol misidentification made easy with format-transforming encryption.&#8221; Proceedings of the 2013 ACM SIGSAC conference on Computer &amp; communications security. 2013.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[11] Vasiliadis, Giorgos, Michalis Polychronakis, and Sotiris Ioannidis. &#8220;MIDeA: a multi-parallel intrusion detection architecture.&#8221; Proceedings of the 18th ACM conference on Computer and communications security. 2011.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[12] Dyer, Kevin P., Scott E. Coull, and Thomas Shrimpton. &#8220;Marionette: A programmable network traffic obfuscation system.&#8221; 24th USENIX Security Symposium (USENIX Security 15). 2015.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[13] Holland, Jordan, et al. &#8220;New directions in automated traffic analysis.&#8221; Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 2021.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[14] Lin, Hui, et al. &#8220;DefRec: Establishing Physical FunctionVirtualization to Disrupt Reconnaissance of PowerGrids\u00e2\u20ac&#x2122; Cyber-Physical Infrastructures.&#8221; The Proceedings of 2020 Network and Distributed System Security Symposium (NDSS). 2020.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[15] Herley, Cormac, and Stuart E. Schechter. &#8220;Distinguishing Attacks from Legitimate Authentication Traffic at Scale.&#8221; NDSS. 2019.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[16] Siadati, Hossein, and Nasir Memon. &#8220;Detecting structurally anomalous logins within enterprise networks.&#8221; Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[17] Liang, Junjie, et al. &#8220;FARE: enabling fine-grained attack categorization under low-quality labeled data.&#8221; Proceedings of The Network and Distributed System Security Symposium (NDSS). 2021.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[18] Kwon, Bum Jun, et al. &#8220;The dropper effect: Insights into malware distribution with downloader graph analytics.&#8221; Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 2015.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[19] Pendlebury, Feargus, et al. &#8220;{TESSERACT}: Eliminating experimental bias in malware classification across space and time.&#8221; 28th USENIX Security Symposium (USENIX Security 19). 2019.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[20] Yang, Limin, et al. &#8220;{CADE}: Detecting and explaining concept drift samples for security applications.&#8221; 30th USENIX Security Symposium (USENIX Security 21). 2021.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[21] Dang, Hung, Yue Huang, and Ee-Chien Chang. &#8220;Evading classifiers by morphing in the dark.&#8221; Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. 2017.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[22] Rossow, Christian, et al. &#8220;Prudent practices for designing malware experiments: Status quo and outlook.&#8221; 2012 IEEE symposium on security and privacy. IEEE, 2012.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[23] Verma, Rakesh M., Victor Zeng, and Houtan Faridi. &#8220;Data quality for security challenges: Case studies of phishing, malware and intrusion detection datasets.&#8221; Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 2019.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[24] Das, Sanjeev, et al. &#8220;SoK: The challenges, pitfalls, and perils of using hardware performance counters for security.&#8221; 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[25] Hassan, Wajih Ul, et al. &#8220;Nodoze: Combatting threat alert fatigue with automated provenance triage.&#8221; network and distributed systems security symposium. 2019.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">[26] Zhang, Wen, et al. &#8220;Decide now or decide later? Quantifying the tradeoff between prospective and retrospective access decisions.&#8221; Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security. 2014.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u7f16\u8005\u8350\u8bed\uff1a\u8be5\u8bba\u6587\u53d1\u8868\u4e8e\u5b89\u5168\u9876\u4f1aIEEE S&amp;P&#8217;10\uff0c\u4e8e\u5341\u5e74\u540e\u83b7\u65f6\u95f4\u68c0\u9a8c\u5956\u3002 \u4f5c&#8230; <a class=\"continue-reading-link\" href=\"http:\/\/202.112.238.40\/wp\/?p=5624\"> Continue reading <span class=\"meta-nav\">&rarr; <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-5624","post","type-post","status-publish","format-standard","hentry","category-research"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/5624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5624"}],"version-history":[{"count":2,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/5624\/revisions"}],"predecessor-version":[{"id":5632,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/5624\/revisions\/5632"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5624"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}