分布式IDS动态可信度反馈调整算法  

Feedback Adjustment Algorithm for Distributed IDS Dynamic Credibility

作　　者：程新党[1] 张新刚[2] 王保平[2] 刘志都[2] 

机构地区：[1]南阳师范学院软件学院,河南南阳473061 [2]南阳师范学院计算机与信息技术学院,河南南阳473061

出　　处：《河南科技大学学报（自然科学版）》2010年第4期39-42,45,共5页Journal of Henan University of Science And Technology:Natural Science

基　　金：河南省基础与前沿技术研究项目(092300410219);河南省重点科技攻关项目(102102210388;092102210377);河南省教育厅自然科学研究项目(2009B520023);南阳市科技攻关项目(2008GG020;2009GG035)

摘　　要：在分布式IDS与安全设备联动系统中,为了对各个IDS的性能进行区别对待,并能对IDS的可信度进行实时调整,设计了动态可信度反馈算法。该算法首先使用D-S证据理论得到各IDS报警信息的综合可信度,然后使用综合可信度对各个报警节点的可信度进行反馈调整,使可信度随着节点的报警行为而实时发生变化,经过一定时间的训练,节点的可信度将成为其性能的准确量化评价,这样聚合后报警将更加真实准确,在一定程度上消除了虚警引起的系统错误联动。To treat different IDS systems respectively based on their performances and to instantly adjust the veracity of aggregated security information in the distributed IDS and security facility coupling system,an algorithm for IDS dynamic credibility aggregation and adjustment was brought forward.The algorithm computes integrated credibility from all the raw alerts by using the D-S evidence theory firstly and then adjusts the old credibility of all the IDSs' alerts by using the integrated credibility interactively.So the credibility of IDS will instantaneously reflect the veracity of its history of alerts.The credibility of nodes will be its accurately quantized valuation after training for a period of time,then the IDSs' alerts should be accurate enough to eliminate improper coupling actions for false alerts to some extent.

关 键 词：分布式IDS 动态可信度 联动 聚合 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]