基于多假设跟踪的入侵场景构建研究  

Research on intrusion scenarios building based on multiple hypothesis tracking

作　　者：李辉[1] 郑庆华[2] 韩崇昭[2] 管晓宏[2] 

机构地区：[1]中国电信股份有限公司上海研究院,上海200122 [2]西安交通大学电子与信息工程学院网络化系统与信息安全研究中心,陕西西安710049

出　　处：《通信学报》2005年第4期70-79,共10页Journal on Communications

基　　金：国家"863"计划基金资助项目(2001AA140213);国家"973"重点基础研究发展规划基金资助项目(2001CB309403)

摘　　要：基于信息融合领域经典的多假设目标跟踪理论,设计了一种模糊化的多假设入侵场景构建方法;对入侵检测系统产生的报警,按照假设形成、模糊假设评价、假设管理的步骤进行自动组织和分析,形成可信攻击片段,并最终从可信攻击片段中自动构建出黑客的入侵场景。在DARPA2000测试数据集上的试验表明,提出的方法是可行的、高效的。A fuzzy multiple hypothesis intrusion scenarios building algorithm was proposed based on multiple hypothesis tracking(MHT)theory which originated from information fusion. The algorithm could automatically analyze and organize alarms produced by intrusion detection systems to form credible attack segments and finally generate intrusion scenarios. The whole process can be divided into three steps, which were hypothesis generation, fuzzy hypothesis assessment and hypothesis management. Experiments on the DARPA2000 IDS test dataset show that the algorithm is effective and efficient.

关 键 词：入侵检测 多假设跟踪 场景构建 信息融合 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]