Network intrusion detection method

Abstract

The invention provides a network intrusion detection method which comprises the following steps: A) capturing data packages in a network; B) carrying out full protocol stack analysis on the captured data packages to obtain protocol variables, that is, each protocol layer data of an original message data package; C) compiling a regular expression rule set into a DFA state transition table through a deterministic finite-state machine, and compressing the DFA state transition table; D) writing the analyzed data in the step B) to the compressed DFA state transition table to carry out matching; and E) outputting the matching result. According to the network intrusion detection method, the data packages are subjected to the full protocol stack analysis, thereby greatly improving the decoding speed, meeting the requirement for real-time decoding, and reducing the demand for the internal storage of a server; and the high-speed message matching is realized through the DFA state transition table, so that accurate detection and defense can be carried out on the existing threat, and advanced evasion technique can be accurately identified and removed.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network intrusion detection method. Background technique [0002] As one of the most important active network security measures at present, network intrusion detection effectively supplements and perfects the security measures such as access control, data encryption, firewall, virus prevention, etc. by identifying and responding to malicious network connections on computers and network resources. Security measures, which improve the integrity of the information security infrastructure, have become an integral part of information system security solutions. [0003] Advanced Evasion Technique (AET, Advanced Evasion Technique) and superimposed cyber-force of stealth attacks have seen many cases of computer attacks infiltrating political struggles in various countries. The recent computer network failure of the Bank of Korea, the US The attacks on the New York Times and W...

AI Technical Summary

Problems solved by technology

[0005] A new interception mode should be considered for advanced stealth attacks. The simple feature library matching mode can no longer fully achieve the interception purpose. Therefore, the present invention will propose a new network intrusion detection method, which will greatly improve the security factor of the network

Images