摘要： 传统的基于Petri网的入侵检测方法只能实现误用检测,而且构造入侵模式的效率太低,不适合如今网络大规模化和入侵复杂化的趋势。针对这两个问题,该文将传统入侵检测过程中的数据分析过程分解为事件产生过程和事件分析过程两个子过程,不仅保留了基于Petri网入侵检测方法原有的优势,而且缓解了入侵模式构造效率低的问题,并且实现了异常检测。实验分析表明,该改进方案对于入侵检测是很有效的。

关键词: 网络安全, 入侵检测, 网络事件, Petri网

Abstract: Traditional detection method basedon Petri net can't meet the need of network enlarging and intrusion complication, since it can only detect misuse detection and has low efficiency in constructing intrusion model. In order to solve the two problems, the traditional data analysis procedure is divided into event generation procedure and event analysis procedure, which keeps the advantages of traditional intrusion detection based on Petri net and solves the bottleneck of efficiency of constructing intrusion model and achieve anomaly detection. Experiments show that this improved methods is effective to intrusion detection.

中图分类号: 

• TP393.08