基于有限状态机协议分析模型的入侵检测系统

The Intrusion Detection Systems Based on the Finite Automat Model

基于状态协议分析的入侵检测方法利用网络协议提供的状态信息,把网络攻击过程转化为协议状态迁移,能有效地检测DOS/DDOS等较难检测的攻击。本文对协议分析入侵检测的方法和算法进行了研究,并通过对网络协议和入侵攻击的深入分析,提出了一个基于有穷状态机的状态协议迁移模型。在给出检测算法的形式化描述的基础上根据Snort规则语法扩展实现实验系统,并测试验证了其有效性。

The intrusion detection approach coverts the network attack to aprotocol state transfer by the state information of network protocol. Some attacks which is difficult to detecte, such as distribute denial of server attacks, can be effectively detected. The paper discusses the technique and algorithms of intrusion detection based on the protocol analysis, and presents a protocol state transfer model according finite automata. The experimental system is implemented mith the expending Snort rules.