IDS告警融合与关联模型的研究  

Study of an IDS Alert Fusion and Correlation Model

作　　者：文颖[1] 胡威[1] 李建华[1] 

机构地区：[1]上海交通大学信息安全工程学院,上海200030

出　　处：《信息安全与通信保密》2006年第8期102-104,共3页Information Security and Communications Privacy

摘　　要：入侵检测是保障网络安全的重要手段,针对现有入侵检测系统中告警数量多、协调性差等问题,论文提出了一种具有告警融合与关联功能的告警处理系统模型,该模型冗余告警量少、整体检测能力强,并能进行攻击企图的预测,能有效提高入侵检测的效率,有助于进一步增强网络的健壮性。Intrusion detection is an important measure to safeguard the network security. Due to the fact that current ID systems have too many alerts and lack of inter-cooperation, the paper presents an alerts process system model based on alert fusion and correlation. The model has the advantage of low redundant alert number and high intrusion detection performance. In addition, it can help anticipate the real intention of attackers￡ thus greatly improve the system＇s efficiency as well as further enhance the robustness of the network.

关 键 词：入侵检测系统 数据融合 数据关联 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]