基于场景和PN机的入侵检测研究

攻击者通过从一个攻击序列衍生出大量变种攻击序列来逃避基于规则及其它误用检测技术的检测.基于此,针对可序列化的入侵,从攻击机理入手,提取攻击的关键操作序列,构造入侵行为表达式,再对攻击序列进行拓扑排序和同构变换,以扩展形成一个入侵场景或一类入侵.进而提出了面向场景和检测一类入侵行为的方法,通过构建基于场景和检测一类入侵行为的PN(Petri Net)机来实现检测已知攻击及其未知变种攻击的目标.未知变种攻击也是一些新的攻击形态,因而从这种意义上说,该方法能检测到新的攻击行为.

Intrusion Detection Based on Scenario and PN Machine

To evade detection of rule-based or other misuse detection methods,the attacker can create a large number of variant attack sequences from one attack sequence.Therefore,aiming at the serializable intrusion,we started to study the attack mechanism,extracted key operation sequence of the attacks,constructed intrusion behavior expressions,sorted topologically attack sequence,and did isomorphic transformation for attack operations.Then one attack can be expanded to one intrusion scenario or one class of attacks.A new intrusion detection method was proposed in the paper,which is called the scenario-oriented intrusion detection.A PN machine for scenario was designed and implemented.The PN machine based on scenario can detect one class of attacks.Then,the goal of detecting the known attack and its unknown variant attacks will be achieved.So,some new derived attacks can be detected by the method in the paper.