The Research Of Instrusion Detection Based On Petri Nets

With the popularity of computer network, the intrusion behavior, such as computer virus attacks, is the great threat to the security of the network. To enhance the ability of the Internet against virus invasion, it is necessary to deeply understand the transmission mechanism of invasion behavior of computer virus on the Internet. Based on fully understanding the characteristics of Internet network, to establish the mathematical model of network intrusion and analyze the transmission mechanism is an important component of network security research.Petri net is a kind of modeling language, graphical and mathematical. The visual graphic description can express the static structure and dynamic changes in a discrete event dynamic system with synchronization, concurrency and conflict. This description is applicable to analyze the static structure of network system and dynamic behavior of the simulation. But classical Petri net model exist some problems, such as state space bang and lack of mathematical approach for the analysis of system performance, and colored Petri net has a hierarchical structure. With the complete formal definition in the aspect of system static model, colored Petri net can be used to evaluate the system performance at the same time, the correctness of logic and validate the system function, also can carry on the simulation interactively or automatically. So it is suitable for large scale system modeling.Therefore, we use colored Petri net modeling technology to design the network intrusion system by introducing security policy domains and interdomain communication channels. The complex network intrusion system is divided into several subsystems and reduces the complexity of constructing network intrusion system. Based on random unpredictability of network intrusion system, combining with the rule base, we introduce the characteristics of stochastic Petri net. By the simulation analysis, relevant features of this model are concluded. Then it provides the reference for building network intrusion system and the development of the network security theory.