Methods of Alert Correlation in Multi-step Attack Based on CPN
Lei Li · Jisuanji gongcheng · 2008
After researching the theory of the Color Petri Net(CPN) and Aiming at the problem in intrusion detection,which is named tire,a CPN attack template,which is separated by the authority that can be gained by the invader,is built in this paper.The complete process of multi-step attack is presented,according to correlate the lowly,disperse alert information in order.Limited template is used in the methods of alert correlation,and the method is simpler and easier to realize than before.Security personnel can predict and appraise the security condition of the network in the angle,which is the authority that can be gained by the invader.