基于有色Petri网的攻击场景构造

Constructing Attack Scenarios Based on Coloured Petri Nets

传统的入侵检测系统只提供大量独立的、原始的攻击报警信息,不利于用户和入侵响应系统对攻击及时作出响应,迫切需要根据低层的报警信息,建立高层的攻击场景。本文提出一种利用有色Petri网理论实时、动态构造攻击场景的方法。该方法首先用有色Petri网描述攻击场景,然后用扩展关联矩阵的比值快速匹配、构造攻击对应的攻击场景;并根据已构造的子攻击场景网,验证和检查漏报的攻击,预测下一步可能的攻击;同时,利用子攻击场景合并的方法构造新的攻击场景模式。

Traditional intrusion detection systems only provide a great amount of indefendent and original attack alarming information,which does not help the users and IDSs to respond to the attacks in time. So the lower level alarming information is needed to build a higher level attack scenario. The paper proposes a method of dinamically buiding a real-time attack scenario using the colored Petri nets principle. The method firstly uses the colored Petri nets to describe the attack scenario, matches and builds the corresponding attack scenario with the ratio of the expanded association matrix, and verifies and checks the omitted attacks, predicts the next possible attack according to the built sub-attack scenario network; and meanwhile builds a new attack scenario mode by using a method of sub-attack scenario merge.