基于异质信息的入侵检测警报过滤机制  

Alarm filtering mechanism of intrusion detection based on heterogeneous information sources

作　　者：于英涛[1] 刘淮松[1] 林中[1] 

机构地区：[1]华北计算技术研究所,北京100083

出　　处：《计算机工程与设计》2006年第17期3181-3183,3298,共4页Computer Engineering and Design

基　　金：国家电子信息产业发展基金项目(XDJZ-0309-01)。

摘　　要：通常误用检测所定义的攻击特征仅限于单一信息,如网络信息或主机信息,而由单一信息所产生的警报,由于针对某些攻击无法精确做出判断,所以误报比例相对较高。针对基于误用检测的网络入侵检测系统,建立了一个警报过滤机制。经过分析,可以找出攻击成功时所需具备的环境条件以及所会呈现的各种不同来源性质的攻击特征,入侵检测系统可据此在发现可疑入侵时,加以及时确认核查。通过运用这些异质信息,可明显减少误报的发生,提高了入侵检测报警的正确率。In intrusion detection systems adopting misuse detection methods, the attack signatures are mostly charactenzecl with information from single data source： for examples, the packet information from the network or the resource utilization information from the host. Without utilizing other available information, the accuracy of judgment made in generating alarm is not satisfactory. An alarm filtering scheme is proposed to improve the efficiency of misuse-type network intrusion detection system. Through careful analysis, a preliminarily recognized attack threat is verified against heterogeneous data sources in determining if an attack may really succeed before it is reported. The expermental result shows that, with the heterogeneous information, the occurrences of false alarm are obviously reduced and none of the real alarms are among those non-reported ones.

关 键 词：入侵检测系统 误用检测 异质信息 警报过滤 减少误报 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]