资源描述：
《基于入侵意图的复合攻击检测和预测算法》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。
1、1000-9825/2005/16(12)2132©2005JournalofSoftware软件学报Vol.16,No.12∗基于入侵意图的复合攻击检测和预测算法+鲍旭华,戴英侠,冯萍慧,朱鹏飞,魏军(信息安全国家重点实验室(中国科学院研究生院),北京100049)ADetectionandForecastAlgorithmforMulti-StepAttackBasedonIntrusionIntention+BAOXu-Hua,DAIYing-Xia,FENGPing-Hui,ZHUPeng-Fei,WEIJun(StateKeyLa
2、boratoryofInformationSecurity(GraduateSchool,TheChineseAcademyofSciences),Beijing100049,China)+Correspondingauthor:Phn:+86-10-88258551,E-mail:xuhua_bao@hotmail.com,http://www.gscas.ac.cnReceived2004-06-11;Accepted2005-06-02BaoXH,DaiYX,FengPH,ZhuPF,WeiJ.Adetectionandforecas
3、talgorithmformulti-stepattackbasedonintrusionintention.JournalofSoftware,2005,16(12):2132−2138.DOI:10.1360/jos162132Abstract:Themulti-stepattackisoneoftheprimaryformsofthecurrentintrusions.HowtodetecttheseattacksisanimportantaspectofIDSresearch.Thecorrelationresearchtointr
4、usiondetectionperformsmainlyonthefollowingaspects:(1)reducingthefalsepositivesandfalsenegatives;(2)detectingunknownattacks;(3)attackforecasting.Especiallythedevelopmentofthethirdpointperhapsimprovesthepassivedetectiontotheactiveprotection.Throughthestudyonpatternsofthemult
5、i-stepattack,adetectionandforecastalgorithmisdesignedformulti-stepattackbasedonintrusionintention.Inthisalgorithm,anextendeddirectedgraphisusedtoshowattacktypesandtheirrelations,whilethecorrelationisperformedaccordingtothemethodofbackwardsmatchingandabsentmatching.Basedont
6、heweightedsummationofcorrelationattack’schainandthebranch’sweightsonthelogicgraphofattack,theprobabilityofthenextattackcanbecomputed.Theeffectofthisalgorithmincludesthedetectionofmulti-stepattack,attackforecasting,detectingunknownattacks,andreducingthefalsealarms.Thispaper
7、alsopresentstheprocessofexperimentalandanalysisresultforvalidityofthealgorithm.Keywords:multi-stepattack;intrusionintention;forecastattack;logicgraphofattack摘要:复合攻击是网络入侵的主要形式之一.如何检测复合攻击是当前入侵检测研究的一个重要方向.这项研究对入侵检测的作用主要表现在以下几个方面:(1)减少误报和漏报;(2)实现对未知攻击的检测;(3)攻击预测.尤其是第3点,可能使被动的检
8、测发展为主动的有针对性的防御.经过对复合攻击模式的大量研究,提出了一种基于入侵意图的复合攻击检测和预测算法.该算法采用扩展的有向图来表示攻击类别及其逻辑关系,按照后向匹配和缺项匹
