Network Threat Behavior Detection and Trend Analysis Based on the TDLC Model
Dong Ma · The Smart Computing Review · 2013
The rapid development of computer networks has accelerated the development of society, but also leads to much more frequent network attacks, and makes the attacks much more complex. Therefore, network intrusion detection becomes a great challenge to security in both industry and academics. In this paper, we present a network detection method based on a collaborative model against network threats and attacks, as well as trend analysis of network structure. First of all, the threat detection level collaboration model is given a specific framework and build process, as well as collaborative mechanisms. We then provide a pattern-matching algorithm and a behavioral sequence template for a simple introduction to this approach, and we explain how to use the collaborative model structure. Finally, the security situation of the entire network is analyzed by a quantitative situation evaluation model, cooperating with the network topology, and the threat type is determined by a D-S evidence theory algorithm. The experiment results show that, while running in an intranet security guard system of a large enterprise, a next-step attack can be predicted by our algorithm, and the security situation of the entire network can be accurately evaluated as well.