基于數(shù)據(jù)分析的網(wǎng)絡安全 第2版（影印版）
定 價：99 元
- 作者：Network security through data analysis / Michael Collins著
- 出版時間：2018/8/1
- ISBN：9787564177300
- 出 版 社：東南大學出版社
- 中圖法分類：TP393.08
- 頁碼：
- 紙張：膠版紙
- 版次：1
- 開本：16K
傳統(tǒng)入侵檢測和日志分析已不足以保護當今的復雜網(wǎng)絡�！痘跀�(shù)據(jù)分析的網(wǎng)絡安全（第2版 影印版）》這本實用指南的第2版中，安全研究員MichaelCollins向信息安全人員展示了新的網(wǎng)絡流量數(shù)據(jù)收集分析技術和工具。你將會理解網(wǎng)絡如何被使用以及哪些行動是加固和防護系統(tǒng)所必需的。
《基于數(shù)據(jù)分析的網(wǎng)絡安全（第2版 影印版）》通過3個部分檢視了收集和組織數(shù)據(jù)的過程、多種分析工具以及各種分析場景和技術。新章節(jié)關注活躍監(jiān)控和流量處理、內部威脅檢測、數(shù)據(jù)挖掘、回歸與機器學習，還有其他主題。
邁克爾·柯林斯，是位于華盛頓的網(wǎng)絡安全與數(shù)據(jù)分析公司RedJack有限責任公司的首席科學家。他主要關注于網(wǎng)絡設備和流量分析，特別是大規(guī)模流量數(shù)據(jù)集的分析。
Preface
Part Ⅰ．Data
1． Organizing Data： Vantage， Domain， Action， and Validity
Domain
Vantage
Choosing Vantage
Actions： What a Sensor Does with Data
Validity and Action
Internal Validity
External Validity
Construct Validity
Statistical Validity
Attacker and Attack Issues
Further Reading
2． Vantage： Understanding Sensor Placement in Networks
The Basics of Network Layering
Network Layers and Vantage
Network Layers and Addressing
MAC Addresses
IPv4 Format and Addresses
IPv6 Format and Addresses
Validity Challenges from Middlebox Network Data
Further Reading
3． Sensors in the Network Domain
Packet and Frame Formats
Rolling Buffers
Limiting the Data Captured from Each Packet
Filtering Specific Types of Packets
What If It's Not Ethernet?
NetFlow
NetFlow v5 Formats and Fields
NetFlow Generation and Collection
Data Collection via IDS
Classifying IDSs
IDS as Classifier
Improving IDS Performance
Enhancing IDS Detection
Configuring Snort
Enhancing IDS Response
Prefetching Data
Middlebox Logs and Their Impact
VPN Logs
Proxy Logs
NAT Logs
Further Reading
4． Data in the Service Domain
What and Why
Logfiles as the Basis for Service Data
Accessing and Manipulating Logfiles
The Contents of Logfiles
The Characteristics of a Good Log Message
Existing Logfiles and How to Manipulate Them
Stateful Logfiles
Further Reading
5． Sensors in the Service Domain
Representative Logfile Formats
HTTP： CLF and ELF
Simple Mail Transfer Protocol (SMTP)
Sendmail
Microsoft Exchange： Message Tracking Logs
Additional Useful Logfiles
Staged Logging
LDAP and Directory Services
……
書單推薦
