The Calculation of Networking Security Event in the Natural Colored Information Reconstruction Process
Sun Mei · Chinese Journal of Computers · 2007
The natural coloring process builds the coloring relationship among different hash functions by the overlapped Short Bit String Mappings,which can be used to determine whether two hash strings are from the same original string.The aggregation relationship and coloring relationship are analyzed from the view point of Quotient set mapping,it suggests that combined with inner balance of Hash functions,the natural coloring process can disclose more bits of original string in the multi Hash aggregation,in the meanwhile the quantity balance of TCP packets is kept.This character of the natural coloring process can be used to detect the IP address(es) and/or port information of victims and/or attackers of TCP macroscopical abnormal behavior such as DDoS,internet worm etc.,the conclusion is validated by the results of two experiments in the real traces.So the natural coloring process extends the application field of quantity balance of TCP packets greatly in networking security event distribution calculation/monitoring fields.