基于因果关系的实时告警关联系统  

Research and implementation on real-time intrusion alert correlation systems based on prerequisites and consequences

作　　者：林昭文[1] 黄小红[1] 苏玉洁[1] 马严[1] 

机构地区：[1]北京邮电大学计算机科学与技术学院,北京100876

出　　处：《高技术通讯》2009年第12期1251-1257,共7页Chinese High Technology Letters

基　　金：863计划(2006AA01Z448);中央高校基本科研业务费(2009RC0502);基础科研项目(A2120061061)资助

摘　　要：针对大规模网络环境下海量告警信息的重复性、不完整和不可管理给网络安全管理带来的新的挑战,提出了一种基于因果关系的实时入侵告警关联(RIAC)系统,以解决海量告警的实时关联和可视化管理问题。此RIAC系统利用分布式Agent实时地捕获和预处理告警信息,然后由因果关联引擎对其进行分析和处理,从而揭示告警信息背后隐藏的攻击场景和攻击意图。使用MIT Lincoln Lab提供的攻击场景数据集LLDOS1.0和真实IPv6数据集对该RIAC系统进行了测试,实验结果验证了其有效性和实时性。On the basis of research and analysis of the current intrusion alert correlation technologies, a real-time intrusion alert correlation （RIAC） system based on prerequisites and consequences was proposed, which could adapt to the large scale, distributed environment and provide an on-line correlation function. The RIAC system employs distributed agents to collect alert information on-line and adopts the prerequisite-consequence correlation method to analysis and discovery attack scenarioes and intrusion intentions behind alerts. A prototype of the system was implemented and its validation test and real-time test were carried out by using the LLDOS dataset of the MIT Lincoln Lab and the real IPv6 dataset. The results show that the RIAC system can correlate alerts and discovery attack scenarioes efficiently and timely.

关 键 词：网络安全 入侵检测 告警关联 攻击场景 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]