利用关联和风险评估方法减少误报和漏报  

Reducing false positive and false negative by correlation and risk assessment

作　　者：赵彬[1] 王亚弟[1] 李立新[1] 李鼎[1] 

机构地区：[1]解放军信息工程大学,郑州450004

出　　处：《计算机应用研究》2008年第10期3105-3107,共3页Application Research of Computers

基　　金：国防预研基金重点资助项目(9140A26010306JB5201)

摘　　要：高误报和漏报率是入侵检测系统面临的主要问题。提出了一种利用关联和风险评估的方法,利用构建的安全关联模型,计算出每个安全事件(如告警事件、系统安全日志记录等)的实时风险值,对风险值较高的事件给出新的警告,并摈弃那些风险值较低的事件,从而降低漏报和误报率。实验结果表明,利用这种方法实现的事件关联系统能够显著降低检测系统的误报和漏报率。The main problems facing intrusion detection systems are high false positive rate and false negative rate. This paper proposed a con＇elation and risk assessment approach to solve these problems, which exploited constructed security correlation model to compute real-time risk for every, security event（ such as alert, operating system log record, and so on） , and gave out new alerts for high risk events while discard low risk ones so as to reduce false positive and false negative rate. The initial test results of event correlation system show that this approach dramatically reduces the rate of false positive and false negative rate of intrusion detection systems.

关 键 词：入侵检测 关联 风险评估 误报 漏报 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]