Research On Network Security Audit And Situation Prediction Technology

With the rapid development of Internet applications, the problem of network security has becomea hot issue while Internet is bringing convenience to people. The existing network security technologiesmainly focus on the data encryption, access control, firewall and intrusion detection technologies,however they are slightly inability for internal network security issues. Network security auditingtechniques developed in the context, it could strictly monitor internal network, improve managementefforts and guarantee the security of the network inside.In this paper, we further study the network security auditing technology based on the commonnetwork applications. On the basis of security audit technical standards and network security auditmodel, a network security auditing system framework is designed; Then we primarily discuss thesecurity audit analysis techniques, propose a behavior analysis model based on the state transition ofapplication layer protocol and a content extraction algorithm with the HTML tag-density, achieve thedeep security auditing analysis of internal network; Meanwhile on basis of network security auditcontrol mechanisms, we propose an improved AC_BM multi-pattern matching algorithm for thesensitive Information audit and audit events query, design rule generation model based on applicationlayer security audit for security audit policy rules management, and design the security socketcommunication mechanism to make sure the security between audit agent and management subsystem;Lastly, we apply the network security situation prediction method for the management of networksecurity audit, propose a network security situation prediction algorithm based real-time audit alarm,and apply for the network management and control.Now we have preliminarily completed the common netwrok application security audit system,compared with other similar audit system, improve the comprehensive security analysis and real-timeresponse ability. Experiments show that network security auditing agent not only has the generalsecurity audit capacity, but also be able to achieve its own security protection; Network security auditmanagement and control system has good analysis and management ability, as well as the wholenetwork security situation prediction capacity.