基于APT攻击的网络检测系统算法优化

以Snort为核心,以分层分布式网络为框架构建基于APT攻击的入侵检测模块的防御系统,并提出了一套新的OTN动态匹配算法。首先,介绍了APT攻击的特点。然后提出了一套针对APT攻击的基于Snort的防御检测模型,并在Snort原有的三步动态调节算法的基础上,提出了一个新的动态匹配算法。最后,用原有的动态匹配算法与改进型动态匹配算法做对比实验,对最终结果进行对比分析。得出结论,采用新型动态匹配算法的分布式网络检测系统对网络安全防护的功能有明显的提高。

Algorithm Optimization of Network Detection System Based on APT Attack

This paper takes snort as the core and builds the defense system of APT attack-based intrusion detection module based on hierarchical distributed network, and proposes a new OTN dynamic matching algorithm.Firstly, the characteristics of APT attacks are introduced.Then a set of snort-based defense detection model for APT attacks is proposed.Based on the original three-step dynamic adjustment algorithm of snort, a new dynamic matching algorithm is proposed.Finally, a new dynamic matching algorithm is proposed.Using the original dynamic matching algorithm and the new dynamic matching algorithm to do the contrast experiment, the final result is compared and analyzed.and the conclusion is that the distributed network detection model using the new dynamic matching algorithm can better meet the needs of network security protection.