Detection of computer attacks using network entities monitoring

• Main Author: Сергей Вячеславович Балакин
• Format: Article
• Language: English
• Published: PC Technology Center 2015-09-01
• Series: Tehnologìčnij Audit ta Rezervi Virobnictva
• Subjects: attack; computer network; network objects; intrusion; informational system; the state of the object
• Online Access: http://journals.uran.ua/tarp/article/view/51120

This article discusses detection of computer attacks by analyzing behavior of the network elements. The aim of this study is to identify attacks using behavior of the network elements and their connections. Detection of computer attacks is the object of the work Modern means of intrusion detection allows us to collect and analyze information from computer networks. In this paper, we propose a model of attacks in the form of transitions of network elements. Transitions can be switched from safe to dangerous mode. Transitions used to filter actions of the system. The results presented in this work show that method is correct. Changes to the formula of attacks improved performance. A model of intrusion detection based on the information about the behavior of network entities can be used in real network. The research results can be applied to protect information by experts in high-speed systems. Achieved one of the main purposes of this work, which was to create a method of intrusion detection based on the analysis of the behavior of network entities. This method detects more dangerous transit ions than the works previously proposed.