A New Detection Method of Abnormal Network Behavior based on the Packet Content
Wang Gong-con · Xinxi wangluo anquan · 2013
This paper presents a abnormal network behavior detection method based on packet contents. Firstly, the abnormal network access is simulated. Secondly, by analyzing the packet content of the network access, the features of the abnormal network behavior are extracted, which are combined with the features of the packet header information to constitute the features of the abnormal network behavior based on the packet contents. A lot of simulation experiments are conducted to extract the features of the abnormal network behavior and then form the abnormal behavior database. The characteristics of network behavior in the formed database are translated into regular expressions. By matching the regular expression of these characteristics with the features of the detected packet content, the detection of the abnormal network behavior becomes more accurately.