一种基于免疫入侵检测的攻击路径标志技术研究

Technology research of attack path identification based on immune intrusion detection

针对免疫入侵检测和攻击源追踪结合技术进行了研究。采用分布式免疫入侵检测系统与数据包标记理论,利用免疫入侵检测系统实时分析的网络数据特征指导路径标志技术动态处理,使路径标志方法能动态自适应不同网络数据特征,快速识别攻击路径,为免疫入侵检测系统针对攻击路径培养特征检测器提供路径信息。实验表明这一方案能快速重构出攻击路径信息,在收敛效率、误报率方面的表现优于目前的概率包标记算法,能为免疫入侵检测系统提供特征路径信息。

This paper did a research regarding the immune intrusion detection system and the IP traceback. By deploying distributed immune intrusion detection and data packet mark, this paper utilized immune intrusion detection system to analysis network packet′s characteristic in real time to instruct path marking technique dynamically, making path marking method adaptable to different characteristics of network data, rapidly recognized attack path, and provided the path information to the immune intrusion detection system with the regard to develop characteristics checker for attack path. Experiments show that this method can reconstruct the information of attack path very fast, and is better than the-state-of-art probabilistic packet marking algorithm in terms of the convergence efficiency and false alarm rate, can provide the information of attack path to immune intrusion detection system.