Identification Method of Attack Path Based on Immune Intrusion Detection

This thesis takes researches on the immune intrusion detection and IP trace back technology. To find out the network data features of the real-time analyses, the distributed immune intrusion detection system and the packet marking theory are used; to guide the dynamically processing of path signs technology, the immune intrusion detection system is used; what’s more, to dynamically adaptive different methods of characteristics of network data, the path signs technology is adopted. After that, the attack paths can be quickly identified to provide path information for feature detector on attack path in the immune intrusion detection system. Experiment results show that this scheme can quickly reconstruct the attack path information, and the performance on the aspects of the convergence is with efficiency rate and false positive rate, which is superior to the current probabilistic packet marking algorithm and can provide characteristic path information for immune intrusion detection system.