基于攻击意图的报警信息关联研究  

The Research of Alert Correlation Based on Attack Intetion

作　　者：柳亚明[1] 许峰[1] 吕志军[1] 黄皓[1] 

机构地区：[1]南京大学软件新技术国家重点实验室

出　　处：《计算机科学》2005年第9期61-65,共5页Computer Science

基　　金：国家"863"高技术研究发展计划项目"分布式网络监控与预警系统"(编号2003AA142010)

摘　　要：当前的入侵检测系统往往只提供给安全管理员大量低级的报警信息,分析这些报警信息极大地加重了安全管理员的负担,并且使得一系列相互关联的重要报警信息常常被淹没在大量不重要的报警信息中,因此迫切需要对于低级的报警信息进行进一步的关联,建立较为高层的攻击场景。本文提出了一个基于攻击意图的报警关联的模型,使用报警信息所对应的攻击行为的目的即攻击意图构建攻击场景。该模型先把入侵检测系统产生的报警信息转化为相应的攻击意图,再根据预先建立的攻击场景对这些攻击意图进行关联,从而实现了报警信息关联。Current intrusion detection systems only offer security administrators a great lot of independent, low-level alert, though there may be logical connections between them. It is a heavy burden for security administrators to analyze so many alerts, and a series of important alerts which are related to each other are often inundated with a large number of unimportant ones. Hence it is necessary to find a appropriate method to construct high-level attack scenarios from low-level attack alerts. This paper presents a model of alert correlation based on attack intention. The proposed approach constructs attack scenarios using attack intentions, i.e. purposes of attack actions corresponding to alerts. When alerts appear, the model turns them into corresponding attack intentions and correlate those attack intentions according to attack scenarios which have been established before.

关 键 词：攻击意图 报警信息 入侵检测系统 网络安全 攻击场景 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]