Three stage progressive network attack characteristic extraction method based on sequence alignment

Abstract

The present invention discloses a three-stage gradual network attack characteristic extracting method based on sequence alignment, wherein a three-stage gradual module is adopted for extracting full attack characteristic of suspected data packages. The network attack characteristic extracting according to the invention comprises a step of sequentially arranging a fist aligning unit (11), a first pruning unit (21), a second aligning unit (12), a second pruning unit (22) and a third aligning unit (13) between one group of suspected data package Pkt and an output characteristic sequence AS which can be used for attack detecting. The first aligning unit (11), the second aligning unit (12) and the third aligning unit (13) adopt a same GASBSLA algorithm for executing aligning procession. The method according to the invention adopts a partial sequence aligning conception and an affine gap penalty model for increasing the generalization degree of attack characteristic, compensates the problem of mutated attack detection difficulty caused by the generalization degree insufficiency of the extracted attack characteristic brought from the prior art using a global aligning conception and weight invariableness penalty model, and at the same time settles the problem of insufficient noise resistance in attack characteristic extracting in the prior art through periodically adopting a method without the pruning strategy.

Description

technical field [0001] The invention relates to a computer network security intrusion detection technology, in particular to a three-stage progressive network attack feature extraction method based on sequence matching. Background technique [0002] Web worms, viruses, and malicious programs are still the number one threat to Internet and enterprise security today, causing hundreds of millions of dollars in losses every year. Signature-based intrusion detection is currently the most effective method to deal with this problem, but the continuous emergence of new attacks and the appearance of deformation engines such as PHolyP make the existing intrusion detection technology be greatly challenged. In order to solve this problem, since 2003, the automatic extraction of attack features has attracted more and more researchers' attention, and has become a new hotspot in the research of intrusion detection technology. [0003] The attack feature extraction algorithms that have bee...

AI Technical Summary

Problems solved by technology

However, since global sequence alignment takes all sequences as matching domains, and all similar parts are used as attack features, a large number of feature sequence fragments of non-attack features are introduced, which makes the false negative rate of the extracted attack features used for intrusion detection rapidly increase

The single pruning strategy also improves the convergence speed while reducing the anti-noise ability, making the extracted attack features inaccurate

Images