Method and apparatus for predicting network attack behaviour

Abstract

The method comprises: monitoring the parameter of network status; using the variation of network status parameters to know the attack action from network; based on the relation between an attack action and its subsequent attack action, selecting an subsequent attack action with maximum probability from all attack actions; said attack action with maximum probability is the one with maximum attack times, and is taken as the forecasted network attack to be outputted. The invention also reveals an apparatus thereof comprising an attack action management unit.

Description

technical field [0001] The invention relates to the field of network communication security, in particular to a method and device for predicting network attack behavior. Background technique [0002] With the rapid development of computer network technology, the degree of informatization of the society is constantly improving. While the network brings huge economic and social benefits to people, it is also facing increasingly serious security problems, and attacks against the network emerge in endlessly. The number and types of attacks are increasing; the attacks are becoming more and more complex; and the harm to users who rely on the network is also increasing. Therefore, in-depth research on the characteristics of network attack behavior is imperative. [0003] The research on network attack can not only start from the attacking individual, but also needs to have an overall understanding of the entire network attack system. But on the one hand, the complexity and divers...

AI Technical Summary

Problems solved by technology

[0007] In the process of realizing the present invention, the inventors found that the prior art has at least the following problems: either the description of the attack behavior in the attack process in the prior art is too simple, the attack process cannot be clearly described, and the large-scale network attack is not reflected. Holistic, not suitable for macro networks

Either simply define the intrusion behavior through four-tuples, and describe the intrusion process with petri nets, without further proposing how to predict and describe the next intrusion behavior

Images