分布式IDS的报警关联定义  

Definition of Alert Correlation in Distributed IDS

作　　者：蒋少华[1] 姚娟[2] 胡华平[1] 

机构地区：[1]国防科技大学计算机学院 [2]华中师范大学信息管理系,湖北武汉430079

出　　处：《计算机与现代化》2006年第6期88-90,共3页Computer and Modernization

基　　金：国家863资助项目(2003AA142010)

摘　　要：网络规模越来越大,传统的IDS往往存在漏报误报率高、报警太低级的问题,因而不能及时准确反映整个系统的安全态势,网络管理人员不得不面对海量的原始报警信息,如大海捞针般地寻找可能的安全威胁和攻击来源。本文首先讨论了现有IDS的不足;之后给出了报警关联的定义。本文的研究成果已经在“网络安全监控与预警系统”(十五863项目)中得到应用,对分布式入侵检测系统的报警关联设计有重要的参考价值。Nowadays, the present IDS has too many false negatives and false positives, and the level of the alert is too low. So it cannot reflect the security situation of the whole network accurately and in time. The administrators have to deal with a lot of raw alerts to the possible security threat and the source of attack just as look for a needle in a bottle of hay. In this paper, the shortages of the present IDS are presented firstly. Then, a definition of alert con＇elation is given. The production of this paper has been applied into ＂the Network Security Monitor and the Warning Technology＂ ,which will do a great deal of good for the design of alert correlation system in distributed IDS.

关 键 词：分布式入侵检测系统(DIDS) 报警事件 报警关联 响应 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]