Formalized description method of network infection behaviour and normal behaviour

Abstract

The present invention relates to a formalized description method of infection behaviour and normal behaviour in the network. It makes meticulous analysis for infection and aggressive behaviour in thenetwork, specially for distributed infection behaviour, on the basis, provides a formalized description method for infection behaviour and normal behaviour in the network. It uses ASSQ quadruple as theoretical basis, on the basis of existent Petri net model makes redefinition and modification, so that the method can be used for tracking and detecting infection behaviour and separating normal behaviour and infection behaviour.

Description

technical field [0001] The invention belongs to the field of network and information security, specifically relates to a formalized description method of normal network behavior and intrusion behavior, and provides theoretical help for a distributed intrusion detection system. Background technique [0002] With the rapid development of computer network technology, the degree of informatization of the society is constantly improving. While the network brings huge economic and social benefits to people, it is also facing increasingly serious security problems. A major threat to network security is the attack and destruction of the network and the intrusion of the information system through the network. A network intrusion is defined as any collection of network activities that attempt to undermine the integrity, confidentiality, or credibility of an information system. Compared with traditional means of destroying information systems, network intrusion has the following chara...

AI Technical Summary

Problems solved by technology

[0004] (2) Attacks through the network are often mixed among a large number of normal network activities, with strong concealment

[0005] (3) The means of intrusion are more concealed and complex

[0010] (4) Malicious use of normal network operations, such as the use of abnormal frequencies, etc., resulting in the collapse of the information system and the denial of service attack (Denial of Service, DoS) that cannot provide services normally

[0016] As the network intrusion behavior becomes more and more complex, the simple intrusion feature description in the past is no longer suitable for the needs of identifying intrusion behavior, which makes the intrusion detection system and firewall and other security components unable to effectively detect complex intrusion behavior

Images