A Method of the Network Attack Process Analysis Based on Dynamic Linking Inference

Based on response after the attack incidents, a method of network attack process analysis by dynamic vulnerability linking is designed. The corresponding color weighted diagraph is setup in dependence on the inference relation of the security holes in the intruded machine. With the vulnerability-log relation matrix, we searched different forensic information sources are searched. The corresponding support value and the remote suspicious host are obtaind. Then the suspicious host in the same way is analyzed. The illustration indicates that this method can get the network attack process rapidly and effectively.