基于改进正则表达式规则分组的内网行为审计方案

发布时间：2018-07-07 10:49

本文选题：正则表达式 + 协议状态　；参考：《计算机应用》2016年08期

【摘要】：针对网络安全审计中对应用层协议审计能力不足的问题,提出一种基于改进正则表达式(RE)规则分组的内网行为审计方案。首先,通过正则表达式对需审计的协议进行描述,并设置相关参数,使内网中出现频率高和审计中相对重要的协议状态在正则表达式描述集中取得高优先级;然后,在正则表达式交互值小的前提下,尽可能地将高优先级协议状态表达式构建到相同自动机分组中以生成审计引擎;最后,根据审计需求,改变相关参数,实现对内网行为的安全审计。实验结果显示,所提出的自动机构建算法在转化时的状态数缩减为经典非确定有限状态自动机(NFA)转化算法Thompson的10%~20%,检测时的吞吐量约为传统自动机分组引擎的8到12倍;所提审计方案能够满足对应用层协议进行安全审计的需求,具有较高的准确性和效率。
[Abstract]:In order to solve the problem of insufficient audit ability of application layer protocol in network security audit, a new behavior audit scheme for intranet based on improved regular expression (RE) rule grouping is proposed. First, the protocol to be audited is described by regular expressions, and the related parameters are set to make the protocol states with high frequency in the intranet and relatively important protocol states in the audit obtain high priority in the regular expression description set. Under the condition that the interaction value of regular expression is small, the high priority protocol state expression is constructed into the same automaton grouping as far as possible to generate the audit engine. Finally, according to the audit requirements, the relevant parameters are changed. Implement the security audit of the intranet behavior. The experimental results show that the number of states of the proposed automata construction algorithm is reduced to 10 / 20 of Thompson's classical finite state automata (NFA) transformation algorithm, and the throughput of the proposed algorithm is about 8 to 12 times that of the traditional automata packet engine. The proposed audit scheme can meet the requirement of security audit of application layer protocol and has high accuracy and efficiency.
【作者单位】：海军工程大学信息安全系;
【基金】：国家自然科学基金资助项目(61100042) 湖北省自然科学基金资助项目(2015CFC867) 信息保障技术国防重点实验室基金资助项目(KJ-13-111)~~
【分类号】：TP393.08

【相似文献】