一个基于复合攻击路径图的报警关联算法  

An alert correlating algorithm based on multi-step attack path graphs:MSACA

作　　者：刘志杰[1] 王崇骏[1] 

机构地区：[1]南京大学计算机软件新技术国家重点实验室 计算机科学与技术系,南京210093

出　　处：《南京大学学报（自然科学版）》2010年第1期56-63,共8页Journal of Nanjing University（Natural Science）

基　　金：国家自然科学基金(60807538,60721002,60503021);江苏省科技支撑计划(BE2009142);教育部重点项目基金(108151)

摘　　要：入侵检测系统作为保护计算机系统安全的重要手段其应用越来越广泛,然而随之产生的大量原始报警事件也带来了新的问题:数量巨大、误报警多、重复报警多,影响了对入侵检测系统的有效利用.针对此问题,警报关联技术成为网络安全研究的一个热点问题,研究者尝试对低级的报警信息进行关联,从而达到降低误报率的目的.本文提出一个基于复合攻击路径图的报警关联算法,使用报警信息在攻击中所处的攻击阶段并将其关联起来构建攻击场景从而达到揭示隐藏在大量攻击事件背后的入侵真实意图.该模型先对报警信息进行预处理,匹配到知识库中对应的攻击阶段,然后再将攻击链接起来,根据攻击路径图的权值计算对应主机的受威胁程度,并决定是否报警.该模型可以实现对报警信息的实时处理,并能重现攻击行为的实施路径,最后通过实验证明了该算法的有效性.For the last years intrusion detection system（IDS） has been proved valuable in protecting computer systems against malicious attacks. It works by actively detecting abnormal activities and counter act,be it reporting to the user or taking certain actions automatically. The traditional IDS,however,is defective in that it deals with the detected abnormal activites only individually,bringing serious problems,classical ones of which include massively false alarms and massively repeated low-level alarms. An even more serious problem of the traditional IDS is that it is not effective,if not uselell,when the many individually detected abnormal activites are correlated components of a multi-step indepth intrusion,which is propably the case in nowadays since intrusions have evolved to be intelligent and distributive. To overcome this defect,this paper proposes a method called MSACA（multi-step attack correlating algorithm）. As a prerequisite of the method,a knowledge database is provided. The knowledge database composes of the structures of known multi-step correlating attack,meaning that given certain low-level abnormal activites,through the database,we can get information regarding to what kinds of multi-step correlating attacks the given low-level alarms may be part of as well as to which stage they belong. The proposed method firstly gets the needed information of the low-level alarms from the database,secondly tries to form a big picture to reveal the possible threat of the low-level alarms working as a whole,and finally takes counter measures. The proposed method can be implemented in realtime scenarios. This paper also proves the proposed method＇s effectiveness by experiments.

关 键 词：入侵检测 报警关联 攻击场景 复合入侵 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]