基于有穷自动机的网络扫描检测算法研究与实现.pdfVIP

汁算机研究与发展 ISSN 1000-12391 CN 11-17771 TP Journal of Computer Research and Development 43(3): 417~422 ， 2006 基于有穷自动机的网络扫描检测算法研究与实现 刘利军 怀进鹏 (北京航空航天大学计算机学院 北京 100083) (liulijun@act. buaa. edu. cn) Research of a Network Scan Detection Algorithm Based on the FSA Model Liu Lijun and Huai Jinpeng ( Schoo[ of Comρuter Science and Engineering , Beihang University , E知ijing 100083) Abstract Network scan is often the prelude of the network intrusion. Thus precise detection of the network scan plays an important role in the pre-alert of the network intrusion. But the current scan detection technologies are too simple and may be eyaded by attackers easily. In this paper , based on the analysis of both the scan and detec~ion technologies , a detection algorithm called SBIPA (FSA-based intrusion pre唰 alert algorithm) is proposed based on the FSA (finite state automata) model and the key implementation technology is analyzed. The state transfer diagram is used to illustrate the network scan packet series , and three different mechanisms are designed to detect the scan event based on FSA. Experiment reveals that this algoi:ithm not only can detect the single type scan activity more precisely , but also can detect the unobvious scan such as distributed and multi-type mixed scan very well , which cant be detected by other detection technologies. It is believed that it eliminates the limitations of the current scan detection technology and has an important .research and practice value. Key words network scan; intrusion pre-alert; FSA; detection algorithm 摘要 网络扫描通常是入侵的前奏，准确的检圳网络扫描可以对网络入侵起到索要的预警作用.现有 的网络扫描检测机制都过于简单且易于被攻击者逃避.提出了一种基于有穷自动机棋型检测网络扫描 的入侵预警算法(FSA翩 based intrusion pre-alert algorithm , S