标题： 网络实体特征描述与攻击预测 显示英文标题

标题： Network entity characterization and attack prediction

摘要： 网络攻击的毁灭性影响凸显了开发新型攻击检测和预防技术的需求。近年来，在攻击检测以及协作防御领域做了大量工作。 然而，对现有技术水平的分析表明，在优先处理告警数据以及研究最近发现的攻击与其再次发生的概率之间的关系方面仍存在许多挑战。 本文提出了一种旨在描述网络实体及其未来可能恶意行为可能性的系统。 我们的系统——网络实体声誉数据库系统（NERDS），综合考虑有关网络实体（如IP地址）的所有可用信息以计算其可能采取恶意行为的概率。 后者通过机器学习实现。 我们的实验结果表明，确实可以使用有关其先前恶意行为和其他特征的信息来精确估计每个实体未来攻击的可能性。 根据此概率对实体进行排名在告警优先级排序、构建长度有限且高度有效的黑名单以及其他用例中具有实际应用价值。 显示英文摘要

摘要： The devastating effects of cyber-attacks, highlight the need for novel attack detection and prevention techniques. Over the last years, considerable work has been done in the areas of attack detection as well as in collaborative defense. However, an analysis of the state of the art suggests that many challenges exist in prioritizing alert data and in studying the relation between a recently discovered attack and the probability of it occurring again. In this article, we propose a system that is intended for characterizing network entities and the likelihood that they will behave maliciously in the future. Our system, namely Network Entity Reputation Database System (NERDS), takes into account all the available information regarding a network entity (e. g. IP address) to calculate the probability that it will act maliciously. The latter part is achieved via the utilization of machine learning. Our experimental results show that it is indeed possible to precisely estimate the probability of future attacks from each entity using information about its previous malicious behavior and other characteristics. Ranking the entities by this probability has practical applications in alert prioritization, assembly of highly effective blacklists of a limited length and other use cases.