Abstract: To evade detection of rule-based or other misuse detection methods,the attacker can create a large number of variant attack sequences from one attack sequence.Therefore,aiming at the serializable intrusion,we started to study the attack mechanism,extracted key operation sequence of the attacks,constructed intrusion behavior expressions,sorted topologically attack sequence,and did isomorphic transformation for attack operations.Then one attack can be expanded to one intrusion scenario or one class of attacks.A new intrusion detection method was proposed in the paper,which is called the scenario-oriented intrusion detection.A PN machine for scenario was designed and implemented.The PN machine based on scenario can detect one class of attacks.Then,the goal of detecting the known attack and its unknown variant attacks will be achieved.So,some new derived attacks can be detected by the method in the paper.

Key words: Intrusion detection,Scenario,Attack sequence,Homogeneous transformation,Topological sorting,Intrusion behavior expression,PN machine