安全报警事件关联算法研究  

Survey of the security alerts correlation algorithms

作　　者：郭山清[1] 阳雪林 曾英佩[1] 谢立[1] 高丛[3] 

机构地区：[1]南京大学软件新技术国家重点实验室 [2]江苏南大苏富特公司研究院,江苏南京210008 [3]奥克兰大学计算机系

出　　处：《计算机应用》2005年第10期2276-2279,共4页journal of Computer Applications

基　　金：国家863计划项目(2003AA142010);国家自然科学基金资助项目(60373064)

摘　　要：已经获得广泛应用的防火墙、IDS、防病毒软件等安全设备在运行过程中会产生大量独立的、原始的报警信息,这些报警信息除了具有海量的特点外,还有比较高的误报率和漏报率,导致用户难于对攻击及时做出响应。利用关联分析的方法对海量报警事件进行分析并提取攻击场景是解决此问题的基本手段。通过简单的分类综述了安全领域中报警事件关联算法的研究现状,并指出了需要进一步研究的问题。security devices （e. g. firewalls, IDS＇s, anti-virus tools etc） that have been widely adopted in enterprise environments may generate huge amounts of independent, raw attack alerts, which are characterized by high false positive ratio and false negative ratio. As a result, it is difficult for users to understand these alerts and respond correspondingly. Therefore, handling the huge number of alerts produced by security devices is becoming a critical and challenging task in network security research. A general approach for solvirig this problem is to do some correlation analysis with these alerts and build attack scenario. A general survey of the contemporary alerts correlation algorithms was given in this paper by a straight forward classification paradigm, and some problems for future research were addressed.

关 键 词：安全管理 报警事件关联 入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]