论文标题
Zeek-Osquery：用于高级监控和入侵检测的主机网络相关
zeek-osquery: Host-Network Correlation for Advanced Monitoring and Intrusion Detection
论文作者
论文摘要
入侵检测系统（IDS）可以分析网络流量，以了解攻击和入侵的迹象。但是，加密的沟通限制了他们的知名度，而复杂的攻击者则尝试逃避其检测。为了克服这些局限性，我们使用来自主机的其他数据扩展了网络IDSS（NIDSS）的范围。为此，我们提出了集成的开源Zeek-Osquery平台，该平台将Zeek ID与Osquery主机显示器相结合。我们的平台可以大规模收集，处理和关联主机和网络数据，例如将网络流归因于流程和用户。该平台可以使用已经相关的，但也可以动态检索的主机数据灵活地扩展到自己的检测脚本。分布式部署使其能够通过任意数量的Osquery主机进行扩展。我们的评估结果表明，一个Zeek实例可以管理超过870个Osquery主机，并且可以将超过96％的TCP连接归因于主机端应用程序和用户。
Intrusion Detection Systems (IDSs) can analyze network traffic for signs of attacks and intrusions. However, encrypted communication limits their visibility and sophisticated attackers additionally try to evade their detection. To overcome these limitations, we extend the scope of Network IDSs (NIDSs) with additional data from the hosts. For that, we propose the integrated open-source zeek-osquery platform that combines the Zeek IDS with the osquery host monitor. Our platform can collect, process, and correlate host and network data at large scale, e.g., to attribute network flows to processes and users. The platform can be flexibly extended with own detection scripts using already correlated, but also additional and dynamically retrieved host data. A distributed deployment enables it to scale with an arbitrary number of osquery hosts. Our evaluation results indicate that a single Zeek instance can manage more than 870 osquery hosts and can attribute more than 96% of TCP connections to host-side applications and users in real-time.
