一种用于网络安全系统的报警聚类与关联模型  

A Model of Alerts Clustering and Association for Network Security Systems

作　　者：韩宗芬[1] 杨志玲[1] 储杰[1] 涂旭平[1] 

机构地区：[1]华中科技大学计算机科学与技术学院,湖北武汉430074

出　　处：《计算机工程与科学》2005年第10期8-9,共2页Computer Engineering & Science

基　　金：武汉市重点攻关资助项目(20031003027);湖北省自然科学基金资助项目(2001ABA001)

摘　　要：针对网络安全系统中普遍存在大量冗余报警的问题,本文提出一种新型报警处理模型。该模型通过相似性评估方法和分层机制对报警信息进行聚类,有效地减少了报警信息量;同时通过关联分析技术挖掘报警信息之间的潜在关联并生成新的规则,增强了识别未知攻击的能力,提高了聚类效率。Aiming at the problem that there are generally a great deal of redundant alerts in network security systems, this paper proposes a new transaction model which clusters the alerts by means of similarity evaluation and a hierarchical mechanism to reduce the amount of alerts efficiently. In addition, this model mines the potential correlation of alerts and produces new rules via association analysis, which will be helpful in recognizing new attack patterns and improving the efficiency of clustering.

关 键 词：网络安全 相似性评估 聚类 关联分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]