一种改进的基于意图识别技术的报警信息关联处理模型  

Improved Model of Intrusion Detection Alerts Correlation Based on Plan Recognition

作　　者：张洪水[1] 贾小珠[1] 纪美霞[2] 

机构地区：[1]青岛大学信息工程学院,青岛266071 [2]青岛滨海学院,青岛266555

出　　处：《青岛大学学报（自然科学版）》2007年第4期73-76,共4页Journal of Qingdao University(Natural Science Edition)

摘　　要：在分析了现有的各种报警关联算法的基础上,提出了基于意图识别技术的报警关联分析模型,并采用了MIT林肯实验室数据对该模型进行了计算机模拟。结果表明,选中的647个初级报警信息经过处理后报警数量减少到112个,说明该模型能够去除无关报警、冗余报警,并可以提高报警的准确率和报警质量。On the basis of the analysis of current intrusion detection alert correlation algorithms, a new model of alerts correlation based on plan recognition was presented. Chosen 647 from MIT Lincoln data were used to simulate the model. The results show that specified raw alerts reduce to 112, which proves that the model can remove the irrelevant and redundant alerts, and improve the alerts＇ accuracy and quality.

关 键 词：入侵检测系统 报警信息融合 意图识别 报警信息关联 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]