基于多挖掘方法和CPN的告警关联系统  

Alert correlation system based on aggregation and CPN

作　　者：张玥[1] 王彦[1] 李斌[1] 张宏莉[1] 

机构地区：[1]哈尔滨工业大学计算机网络与信息安全技术研究中心,黑龙江哈尔滨150001

出　　处：《信息安全与通信保密》2006年第12期167-168,共2页Information Security and Communications Privacy

摘　　要：网络攻击越来越复杂,入侵检测系统产生大量告警日志,误报率高,可用性低。为此,论文提出采用聚类分析、关联挖掘算法和基于彩色Petri网的联合挖掘多步骤攻击方法进行IDS告警关联,从宏观和微观攻击轨迹角度重建攻击场景,提高了入侵检测系统的可用性。Network attack techniques become more and more complexity, IDS produce a large of alerts, and falut positive is high, availability is low. So, we introduce combinative algorithem based on aggregation analysis, correlation, and CPN method to accomplish the attacks correlation, from macroscope and microscope view we rebuild attack scenario, impore IDS＇s usabiliy.

关 键 词：入侵检测 彩色Petri网 告警关联 攻击场景 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]