Forecast algorithm for multi-step attack based on attack intention
Han Ji-hong · Jisuanji gongcheng yu sheji · 2007
Attack can be only detected,but the attacker's next attack can't be forecasted by intrusion detection system.The default of the approach to forecasting attack based on attack behavior is analyzed,a forecast algorithm for multi-step attack based on attack intention is addressed.Multi-step attack is modeled by attack intention and the logic relationship between attack intention is expressed by extended directed graph.The attack intention frame of attack for attack to match is addressed.The degree of detected attack and matched attack is defined.At the end,the validity of the algorithm is proved by the experimental results.