基于混合关联的警报处理方法研究  

An approach to handling alarm based upon hybrid correlation

作　　者：冯光升[1] 王慧强[1] 王增全[1] 

机构地区：[1]哈尔滨工程大学计算机科学与技术学院,哈尔滨150001

出　　处：《大连海事大学学报》2008年第3期93-97,101,共6页Journal of Dalian Maritime University

基　　金：国家"八六三"高技术研究发展计划项目(2007AA01Z401);教育部高等学校博士学科点基金资助项目(20050217007)

摘　　要：为减少入侵检测系统产生的大量相互独立的警报信息并揭示警报背后所蕴含的攻击策略,将警报处理过程分为相互联系的两个方面:横向关联和纵向关联.通过对相似警报的聚类融合,实现警报横向关联,降低警报数量;以横向关联的结果作为纵向关联的输入,通过分析在一定时间窗内发生警报的因果关系,实现警报的纵向关联,剔出虚假警报,揭示攻击者所采取的攻击策略.实验结果表明,在发生密集型攻击时采用混合关联策略仍能实现高检测率、低误警率的目标,同时能够刻画出警报之间的关联关系.该研究成果对于网络安全态势预测研究具有重要的参考价值.To reduce the volume of alarms generated by intrusion detection systems, which seemed unrelated with each other, and discover the strategies taken by attackers, the alarm processing was divided into such two inter-relative steps as transverse correlation and vertical correlation. Through clustering and fusing similar alarms, transverse correlation was implemented which resulted in a tremendous decrease in the volume of alarms. Taking the results of first step as the input, it was feasible to apply vertical relation. As a result, most of false alarms were removed as well as the attack strategies was revealed. The experimental results show that the proposed method has high detection rate and low false alarm rate. Meanwhile, the alarm relations could be described. Moreover, the result would be applied to the forecast of network security situation awareness.

关 键 词：网络安全 入侵检测 警报关联 警报聚类 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]