Formalized description method of network infection behaviour and normal behaviour

The present invention relates to a formalized description method of infection behaviour and normal behaviour in the network. It makes meticulous analysis for infection and aggressive behaviour in thenetwork, specially for distributed infection behaviour, on the basis, provides a formalized description method for infection behaviour and normal behaviour in the network. It uses ASSQ quadruple as theoretical basis, on the basis of existent Petri net model makes redefinition and modification, so that the method can be used for tracking and detecting infection behaviour and separating normal behaviour and infection behaviour. 本发明为一种网络入侵行为和正常行为的形式化描述方法。本发明对于网络中存在的入侵和攻击行为，特别是分布式入侵行为，进行了细致分析，在此基础上，提出了一种对于网络行为和正常行为的形式化描述方法。本方法以ASSQ四元组为理论基础，在已有Petri网模型的基础上，进行了重新定义和修改，可以应用在各种入侵检测和相关的系统中，用来跟踪、检测入侵行为，区分系统正常行为和入侵行为。