Honeynet中的告警日志分析  

Analysis of Alert Correlation in Honeynet

作　　者：武斌[1] 郑康锋[1] 杨义先[1] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876

出　　处：《北京邮电大学学报》2008年第6期63-66,共4页Journal of Beijing University of Posts and Telecommunications

基　　金：国家"973计划"项目(2007CB310704)

摘　　要：提出一种带有告警日志分析的蜜网(honeynet)架构设计和告警日志分析模型.将网络入侵检测和主机入侵检测的告警信息相结合,利用网络信息和告警相似度函数进行告警过滤和融合,采用改进的apriori算法挖掘告警的关联规则,并通过匹配规则形成最终的攻击报告.实验表明,该方法能有效减少honeynet中冗余的告警,分析出honeynet系统遭受攻击的关联关系,并展现攻击场景.A honeynet architecture with the analysis model of alerts is proposed. The new design of honeynet combines alerts of network intrusion detection system （NIDS） and host intrusion detection system （HIDS） to find out the correlations among them. The alerts are filtered and merged using the network information and similarity membership function. An improved apriori algorithm is applied to discover the alert correlation knowledge which is matched to construct attack scenarios. Experiments demonstrate that with the analysis model of intrusion detection system （IDS） alerts the redundant IDS alerts decrease efficiently and the correlation relationships of different attacks are constructed accurately.

关 键 词：蜜网 入侵检测 告警关联 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]