Timed Coloured Petri Net Model for Misuse Intrusion Detection

Misuse detection is the process of attempting to identify instances of network attacks by comparing current activity against the expected actions of an intruder. Most current approaches to misuse detection involve the use of rule-based expert systems to identify indications of known attacks. However, these techniques are less successful in identifying attacks which vary from expected patterns. This paper presents a general model based on timed coloured Petri net, capable of handling patterns generated to model the attack behavior as sequence of events. This model also allows flagging an attack, when the behavior of one or more processes matches the attack behavior. In addition, graphical representation of a timed coloured Petri net gives a straightforward view of relations between attacks