基于数据包内容的网络异常行为分析方法研究

文章通过模拟网络异常访问行为，对数据包内容进行解剖分析，提取数据内容所反映的异常行为特征，结合数据包包头特征信息，构成基于数据包内容的网络异常行为特征。通过大量模拟实验，以提取的网络异常行为特征为记录，形成异常行为数据库。在网络异常行为检测过程中，将异常行为数据库中的特征翻译成正则表达式，与检测到的数据包内容特征进行匹配，以此较为准确地判断数据包是否臭奄舟靠行为。

A New Detection Method of Abnormal Network Behavior based on the Packet Content

This paper presents a abnormal network behavior detection method based on packet contents. Firstly, the abnormal network access is simulated. Secondly, by analyzing the packet content of the network access, the features of the abnormal network behavior are extracted, which are combined with the features of the packet header information to constitute the features of the abnormal network behavior based on the packet contents. A lot of simulation experiments are conducted to extract the features of the abnormal network behavior and then form the abnormal behavior database. The characteristics of network behavior in the formed database are translated into regular expressions. By matching the regular expression of these characteristics with the features of the detected packet content, the detection of the abnormal network behavior becomes more accurately.