An Attack Detection Method Based on Fuzzy Uncertainty Reasoning

Abstract

The invention relates to an attack detection method based on fuzzy uncertainty reasoning, which belongs to the technical field of network information security. Suitable for misuse detection systems. On the basis of extracting fuzzy attack features and establishing fuzzy knowledge templates, the present invention uses fuzzy reasoning technology to detect the possibility of attack occurrence. The misuse detection system adopts the method of the invention, which can effectively improve the detection accuracy of attack behavior and variants thereof.

Description

technical field [0001] The invention relates to an attack detection method based on fuzzy uncertainty reasoning, which belongs to the technical field of network information security. Suitable for misuse detection systems. Background technique [0002] Network attack detection technology collects log data that may contain attack traces from the network, and finds possible attack behaviors by analyzing the data. From the perspective of detection methods, intrusion detection technology can be divided into two categories: anomaly detection and misuse detection. Misuse detection technology needs to establish an attack knowledge template in advance, and then extract the attack evidence from the log data. By matching the attack evidence with the attack knowledge template, if it matches, it is considered an attack; otherwise, it is not considered an attack. [0003] At present, misuse detection mainly adopts deterministic reasoning technology, that is, the knowledge template and m...

AI Technical Summary

Problems solved by technology

Therefore, if the attack process slightly deviates from the process defined by the template, the matching results will not match, resulting in the inability to detect the corresponding attack behavior