报警信息聚合研究  

The Study of Alert Aggregation

作　　者：胡振华[1] 张永胜[1] 逯义军[2] 徐震[1] 

机构地区：[1]山东师范大学信息科学与工程学院,山东济南250014 [2]山东师范大学管理与经济学院,山东济南250014

出　　处：《计算机安全》2009年第2期77-80,共4页Network & Computer Security

摘　　要：入侵检测系统的诸多不完善的因素制约了入侵检测的发展,入侵检测一直也成为人们研究的一个重点,而报警信息聚合可以有效地减少报警数量,提高网络预警能力,对入侵检测系统有着十分重大的意义。首先将报警分成四大类,再判定不同类别中报警信息的关系,进行聚合,最后根据不同的属性找出各报警信息的关联关系。The imperfections the intrusion Detection System constraining the development of Intrusion Detection ,and Intrusion Detection has also become a focus of study. Alert aggregation, it very important to the Intrusion Detection System, can effectively reduce the member of alefts,and it can increase network warning ability. First,we categorize all alerts into four classes according to the attack event type, then make sure the relationship of the alerts and aggregate them, and find out the correlation between them finally.

关 键 词：入侵检测 报警 分类 聚合 关联 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TN916.38[自动化与计算机技术—计算机科学与技术]