Simulation of network intrusion detection system with GPenSim

Abstract

In recent years, network has penetrated into every aspect of our life with its rapid growth and popularization. More and more serious network security problems have occurred together with this process, especially network intrusion problem. It has seriously affected the normal use of network, so research of network intrusion detection has become one of the hottest research areas. This thesis simulated a network intrusion detection system based on particle filter to solve the network intrusion problems. It can filter the intrusion behaviors by using particle filter technique into network intrusion detection. This thesis simulates against two specific intrusion behaviors (intrusion and Trojan). The tool used for modeling is colored Petri net which is built up on basic Petri net. Colored Petri net can model complex object by adding specific meaning to tokens. It also supports structured modeling, which can divide complex object into several parts. This thesis emphasized on the process of simulating with colored Petri nets. It simulates two network intrusion systems against intrusion and Trojan behaviors. Both of the two models for network intrusion detection system are divided into three modules. The models, functions and connecting methods of these modules are presented in the thesis. The meaning of the places and color spaces of tokens in the model are presented in detail. The meanings of the transitions and requirements for them to fire are also introduced. This thesis programs with GPenSIM (General Purpose Petri Net Simulator) toolbox. The problems in the simulation and the process of solving them are described. The result of the simulation is also presented and analyzed.