Complex attack identification technology for wireless intrusion detection system

Abstract

The invention relates to a complex attack identification technology for a wireless intrusion detection system. The complex attack identification technology for a wireless intrusion detection system comprises the following steps: step 1, data acquisition; step 2, single step attack identification; step 3, complex attack identification; step 4, information display interface. The beneficial effect of the invention comprises: 1) the hybird architecture is applied to the identification of the single step attack, the identification accuracy of the single step attack is enhanced, and the false positives and false negatives are reduced; 2) the evaluation mechanism is used for identifying the complex attack, and the simple yes or no is not used for judging the single step attack behaviors, so that the attack sequence is generated, therefore, the distortion of the final result due to the information distortion among the modules can be effectively reduced; 3) an algorithm for identifying the complex attacks and predicting the final intention of the attackers is designed, which has better prediction results for complex attack intention with obvious characteristic behaviors.

Description

technical field [0001] The present invention relates to complex attack recognition technology, more specifically, it relates to a recognition technology for recognizing complex attack and predicting attacker's final intention. Background technique [0002] In recent years, wireless networks have become more and more popular. Whether it is in the company, public places or consumers' homes, wireless local area network WLAN will be deployed, and the very rich access points AP also greatly facilitate people, especially users who use mobile terminals. . The number of mobile users has been increasing over the years, and many applications such as social networking, games, audio-visual, news, finance, etc. are increasingly inclined to allow users to use mobile terminals to interact, which is a natural advantage of mobile terminals. However, due to the defects of the wireless communication protocol itself, or the loopholes left in the manufacture of these mobile devices, the user's ...

AI Technical Summary

Problems solved by technology

Another fact is that both offensive and defensive sides are developing, and attackers are also developing more complex attack techniques in order to achieve their goals

At present, attackers aiming at the wireless network environment often implement many attack steps to get close to the target, which greatly increases the difficulty of intrusion detection or defense, while traditional misuse detection such as Snort rules is only suitable for single-step attacks, and for complex attacks At present, the research is mainly focused on the field of wired intrusion detection. However, there are great differences in attack behaviors between wireless networks and wired networks. Mobile terminals, etc.; attack levels are different. Wired network attacks are mostly at the network layer and above, while wireless network attacks involve the physical layer and logical link layer; attack methods are different. Wired network attacks often detect host vulnerabilities to intrude, while wireless network attacks mainly It is to crack the key, illegal access or disguise to operate the traffic. Due to these particularities of wireless attacks, there is no effective multi-step wireless attack detection technology applicable to complex attacks.

Images