June 2016
Beginner to intermediate
376 pages
8h 58m
Japanese
Content preview from データ分析によるネットワークセキュリティ
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
256
12
章 ボリュームと時間の分析
本当の略奪を、略奪的な異常から区別するには、ボリュームに対する閾値を調整する必要がある。
それには可視化が必須だ。10章で標準偏差の問題を取り上げたが、ヒストグラムは、問題の分布が
ガウス分布に従うかどうかを判断する最も簡単な方法である。私の経験では、驚くほどたくさんの
サービスが定期的にホストから「略奪」している。Webスパイダやインターネットアーカイブなどが
顕著な例である。サイトが完全に内部にある場合にも、バックアップや内部監視が偽陽性として検
出される。
可視化するとこのような外れ値を特定できる。図12-3の例では圧倒的多数のトラフィックが約
1000 MB/10分以下で発生している。しかし、2000 MB/10分以上のわずかな外れ値があり、これら
が
calibrate_raid.py
だけでなく、大部分の学習アルゴリズムに問題をもたらす。外れ値を特定した
らホワイトリストに記録し、
--not-dipset
を使ってフィルタコマンドから取り除く。こうしておけば、
rwcount
を使って簡単な警告メカニズムを構築できる。
過度の外れ値を含むボリューム観測
ボリューム（パケット、6分サンプル）
図12-3 外れ値を含むトラフィック量。外れ値の発生源と原因を解明すると警告が減少する
12.4
局所性
局所性とは、参照（メモリ位置、URL、IPアドレス）が集まる傾向を指す。例えば、時間とともに
ユーザが訪問するWebページを調べると、ページの大部分が少数の予測可能なサイト ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.