入侵报警管理与入侵响应系统IDAM&IRS中的自适应报警聚合  

Adaptive Alert Aggregation in Intrusion Detection Alert Management & Intrusion Response System

作　　者：穆成坡[1] 黄厚宽[2] 田盛丰[2] 

机构地区：[1]北京理工大学宇航科学技术学院,北京100081 [2]北京交通大学计算机与信息技术学院,北京100044

出　　处：《计算机科学》2007年第12期73-77,90,共6页Computer Science

基　　金：国家自然科学基金项目(60442002);北京交通大学科技基金项目(2004SM010)

摘　　要：本文简要介绍了入侵报警管理与入侵响应IDAM&IRS系统的结构与功能,阐述了重复报警所造成的安全问题以及报警聚合的必要性。对报警聚合所涉及的有关问题进行了详细的讨论,提出了基于报警类型的自适应报警聚合方法。此方法可以有效聚合重复报警,解决了重复报警所产生的通讯堵塞等问题,能够在报警数量和报警种类之间取得很好的平衡。由于其自适应性,此报警聚合模型为后续深入的报警处理提供了有利支持,较好地解决了安全性与实时性之间的矛盾。The architecture and functions of Intrusion Detection Alert Management ＆ Intrusion Response System （IDAM＆IRS） are briefly introduced in this paper. The problems caused by repetitive IDS alerts are presented. Based on a detail discussion of alert aggregation, the paper proposes an adaptive alert aggregation approach. The approach can effectively aggregate repetitive alerts, and meanwhile adjust stay times of aggregated alerts in the buffer area automatically according to corresponding alert types. The problems caused by repetitive alerts, such as network traffic jam etc., are solved and a balance between alert amount and alert type is achieved in the proposed model. In addition, the alert aggregation approach provides a strong support for the further alert processing in IDAM＆IRS and balances the speed and security of a network system.

关 键 词：报警聚合 报警处理 入侵检测 入侵响应 

分 类 号：TP277[自动化与计算机技术—检测技术与自动化装置]