Signature Analysis Mathematical Model of Network Traffic and Experimental Evaluation of Its Functioning Efficiency

Relevance. In modern attack detection systems (ADSs), signature analysis algorithms are key components in the process of analyzing network traffic. Their widespread use in implementation of attack detection rules is due not only to the ease of their configuration and search speed, but also to the ability to detect attacks with zero false positives. This is achieved by specifying such sets of special rules (signature rules) that uniquely identify a specific type of attack. The development and optimization of models and algorithms for constructing such rules is an urgent task, since its solution allows increasing the level of protection of network resources from attacks. The purpose of the research is to improve the operating efficiency of ADSs built on the basis of signature analysis. Methods used. The research is based on the application of provisions from the theories of sets and information retrieval, as well as parallel and network programming techniques. The subject is models and algorithms for signature search of attacks in network traffic, the object is signature ADSs. Novelty. The paper presents a mathematical model of signature analysis of network traffic, which differs from known analogs in the universality of the representation of signature rules and support for multi-level processing of both individual packets and network data flows; an assessment of the effectiveness of the software implementation of this model is performed. The universality of the representation of signature rules is achieved due to the possibility of their expansion with new rules regardless of their internal implementation and without the need to reconstruct the original model. Multi-level processing of packets and network data flows by signature rules is ensured by the IP defragmentation and TCP reassembly algorithms developed and integrated into the model. Practical significance . The result of the experiment shows that the developed network traffic analyzer demonstrates performance that is 1,5 times superior in terms of promptness and resource consumption to other open source ADSs. Thus, the developed model can be used in constructing an effective ADS.