基于多层模糊综合评判的入侵检测系统报警验证  

Intrusion detection alert verification based on multi-level fuzzy comprehensive evaluation

作　　者：穆成坡[1] 黄厚宽[1] 田盛丰[1] 

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044

出　　处：《计算机应用》2006年第3期553-557,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(60442002)

摘　　要：提出了一种基于多层模糊综合评判的报警验证方法,此方法不但可以有效地减少误报,还可以对不同情况下的无关报警进行滤除和标记等不同的操作,很好地处理验证过程中的各种不确定因素。所得的报警相关度参数有利于制定细致、灵活的报警处理策略,从而对报警进行更深入的自动化处理。An alert verification approach based on multi-level fuzzy comprehensive evaluation was presented. Experiments prove that it is effective to reduce false alerts and irrelevant alerts. The algorithm can deal with the uncertainties better than other alert verification approaches. The relevance score vectors obtained from the algorithm facilitate the formulation of fine and flexible security policies, and further alert processing.

关 键 词：入侵检测 报警验证 模糊综合评判 报警处理 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]