An Attack Signatures Generation Sequence Alignment Algorithm Based on Production Rules

Abstract

Aiming at the problem that the result of some attack sequence alignment methods is not necessarily the optimal expression of their characteristics. This paper presents a Production Rule Sequence Alignment Algorithm (PRSA) combining the production rule inference mechanism which improves traditional sequence alignment algorithm. A new accumulation of knowledge is obtained by changing the way of sequence alignment and the transformation of signatures. PRSA overcomes the problem that the extraction results produced by the traditional sequence alignment algorithm cannot express the attack signature accurately. Then, we establish an automatic attack signature generation model based on PRSA. The experimental results show that the matching results obtained by using PRSA can express the signatures of the attack accurately and improve the detection rate of the attacks.