Multi-mode Detection Network Attack Model

Since entering the 21 st century, computer networks in people’s lives has been widely developed and applied, has become an indispensable part of our lives. However, with the growing number of network applications, but also provides for network attackers have to take advantage of the machine. In recent years, according to data released by the National Internet Network Information Center show that cyber attacks to rise, it gives users a very big potential threat. What’s more, many users have caused incalculable damage. To the user can use the network more secure, prevent users suffer network attacks, which makes the detection of cyber attacks has become very important and urgent research. Currently, the biggest problem faced by network attack detection algorithm to detect the impact of the efficiency and network environments for detection algorithm, so how to improve the performance of network attack detection is an urgent problem.The main research of this thesis is to propose a multi-mode network attack detection model, the first focuses on the principles and detect network attacks, in traditional network attack detection, mainly based anomaly detection and misuse detection to achieve. In the analysis of the situation faced by anomaly detection under a high false alarm rate, select misuse detection as a multi-mode entry point for network attack detection model, studied the pattern detection algorithm in the network attack detection, select multi-mode detection algorithm proposed as a model with detection algorithm. Then this thesis commonly used in multi-mode detection algorithm is also conducted in-depth research and found that the multi-mode detection algorithm used in the current network attack detection remains to be optimized in terms of performance, it is mainly manifested in excessive rollback, each not skip redundant characters and using the chain store to find after the match fails, etc., in the pattern set under a lot of cases, it will seriously affect the overall performance of the algorithm. To solve this problem, this thesis multi-mode AC algorithm, ACBM algorithm and WM algorithm is improved. After the improved algorithm can well avoid invalid window back or increase the distance after the match failed to find or improve the efficiency of the algorithm, such as in the case of large pattern set for testing, the improved algorithm can significantly improve the detection algorithm 20 % to 50% performance. According to the multi-mode detection algorithm to improve after the depth of excavation, found that each detection algorithm in different network environments demonstrated by the performance of the situation is not the same, the combination of different network environment scenarios, this thesis presents the static and dynamic adaptive scheduling adaptive scheduling algorithm for joint decision-making mode selection, enabling detection algorithm in the current network environment show better performance, avoiding the single detection algorithm can not adapt to the network environment to play a better performance defects.Finally multi-mode detection algorithm based on improved after the static and dynamic adaptive adaptive design a multi-mode network attack detection model, and then in the network attack detection program based on the model of the system design and testing, validation of this thesis mentioning that the good performance of the improved algorithm, static adaptive and dynamic adaptive three aspects.