一种分布式IDS报警聚合模型的设计与实现  

Design and implementation of distributed IDS alert aggregation model

作　　者：郭帆[1] 叶继华[1] 余敏[1] 

机构地区：[1]江西师范大学计算机信息工程学院,南昌330022

出　　处：《计算机应用研究》2009年第1期325-329,333,共6页Application Research of Computers

基　　金：国家"973"计划资助项目(2006CB303006;2007CB316505);江西师范大学博士基金资助项目(20071952)

摘　　要：提出了一种分布式报警聚合模型,由本地和网络组件构成,本地组件将传统IDS上报的原始报警转换为基于IDMEF模型的统一报警信息格式,网络组件接收统一格式的IDMEF报警,采用基于分类和属性相似度的报警聚合方法聚合重复报警信息为超报警,模型中设计了多种消息内容用于满足本地组件和网络组件间通信需求,使得整个网络可以信息共享,根据该模型可以较经济地搭建一个分布式入侵检测系统。The article proposed a distributed alert aggregation model, composed of local component and network component. Local components transform raw alerts originating from traditional IDS to IDMEF-based alerts with uniform format, which were sent to network components. Network components aggregate similar alerts into a meta-alert, using an aggregation algorithm based on feature similarity computation. Multiple kinds of messages were proposed to meet the demands of the communication between the components and realized information share in the whole network. It＇s economical to construct a distributed IDS under the model.

关 键 词：报警 聚合 相似度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]