Condition detection based protocol abnormity detecting method and system

Abstract

The present invention relates to a based on a status measure protocol abnormal measure method and system. The foundation of a protocol normal running state model comprises the examination of a protocol formal description expression and the making of a correlation protocol state machine; a protocol running state orientation moment realizes the exact orientation of the used protocol state in the present conversation towards the exact network communication data message; a protocol running state moving moment realizes the forecast of the next likely ongoing state moving and makes a normal state running concourse of the after-orientation protocol state; an abnormal examination moment judges whether the present protocol running accords with the protocol standard model and return the examination result by the gained subsequent message and the forecast running concourse. The present invention can check the correlative abnormal protocol in the network protocol communication process according to the exact protocol of the practically gained message and can conveniently expand the protocol normal running model according to the practical requirement.

Description

technical field [0001] The invention belongs to the field of network technology, and performs protocol anomaly detection according to protocol specifications used in messages in network data streams, and in particular relates to a state detection-based protocol anomaly detection method and system that can be used in intrusion detection systems and audit products. Background technique [0002] As an important means of network security protection, the IDS-Intrusion Detection System is usually deployed inside the key network or at the entrance of the network boundary. intrusions and take appropriate action. The current intrusion detection methods are mainly divided into misuse detection technology and anomaly detection technology. Anomaly detection can detect known and unknown attacks, but the establishment of normal behavior models can only be generated based on international standards and using artificial intelligence, machine learning algorithms, etc., requiring a lot of da...

AI Technical Summary

Problems solved by technology

At present, there is a shortage of products with complete protocol anomaly detection functions. Therefore, it is necessary to develop a complete and easy-to-extend protocol anomaly detection technology, to make up for the lack of misuse detection technology as much as possible, and to improve intrusion detection or auditing systems on a larger scale. Detection and defense capabilities for unknown attacks

Images