一种改进的基于因果关联的攻击场景重构方法  

An Improved Attack Scenarios Reconstructing Method Based on Causal Correlation

作　　者：吴庆涛[1] 路凯[1] 李连民[1] 

机构地区：[1]河南科技大学电子信息工程学院,河南洛阳471003

出　　处：《微电子学与计算机》2009年第6期121-124,128,共5页Microelectronics & Computer

基　　金：河南省重点科技攻关项目(082102210076)

摘　　要：使用因果关联方法构建攻击场景时,漏报警易引发关联图的分裂.针对此问题,提出了一种改进的基于因果关联的攻击场景重构方法.该方法根据报警相关度确定可组合的关联图,利用网络弱点和攻击关系推出漏报警,使得分裂的关联图能够组合起来,进而重建完整的攻击场景.实验结果表明了该方法的有效性.Causal correlation method was one of the most representative methods for reconstructing attack scenario. However, the correlation graph would be split because of missing alerts in some condition. This paper proposes an improved attack scenario reconstructing method based on causal correlation. The method identifies the correlation graphs to be integrated through alert relativity, and reasons out missing alerts by analyzing network vulnerability and exploit. The experimental results show that the method is valid to combine the split correlation graphs and reconstruct attack scenario.

关 键 词：因果关联 攻击场景重建 网络弱点 

分 类 号：TP31[自动化与计算机技术—计算机软件与理论]