基于CPN的规划识别及多步骤攻击检测方法  

Methods of plan recognition and multi-step attack detecting based on CPN

作　　者：张卫华[1] 范植华[1] 

机构地区：[1]中国科学院软件研究所,北京100084

出　　处：《计算机工程与设计》2007年第11期2516-2519,2565,共5页Computer Engineering and Design

摘　　要：在Kautz规划识别算法基础上,利用CPN作为新的规划表示和识别方法。与目前规划识别领域广泛使用的Kautz表示方法相比,新的表示方法更加简便与高效。以多步骤攻击检测作为实例,通过计算行为间的变迁关系,以重新得到攻击全貌。Based on Kautz plan recognition algorithm, Agent＇s belief and intention are analyzed from the action being observed. A new plan formalism method and a CPN concept compared with Kautz＇s formalism used widely in plan recognition, this method is simpler and more direct. A method about CPN is introduced to modeling the action of network intrusion detection based on CPN; by matching the relationship of the alerts, it can obtain the stage of the attack.

关 键 词：规划识别 多步骤攻击 CPN 报警关联 网络安全 

分 类 号：TP18[自动化与计算机技术—控制理论与控制工程]