基于状态机的入侵场景重构关键技术研究  

Research on the key technology of reconstructing attack scenario based on state machine

作　　者：冯学伟[1] 王东霞[1] 马国庆[1] 李津[1] 

机构地区：[1]北京系统工程研究所,北京100101

出　　处：《微型机与应用》2010年第17期57-61,64,共6页Microcomputer & Its Applications

摘　　要：分析了现有的各种安全事件关联算法,提出了一种基于状态机的攻击场景重构技术。基于状态机的攻击场景重构技术将聚类分析和因果分析统一起来对安全事件进行关联处理,为每一种可能发生的攻击场景构建一个状态机,利用状态机来跟踪、记录攻击活动的发展过程,以此来提高关联过程的实时性和准确性。最后通过DARPA2000入侵场景测试数据集对所提出的技术进行了分析验证。The paper analyzes the existing algorithms of security events correlation and proposes an attack scenario reconstruction technology based on state machine. The attack scenario reconstruction technology based on state machine processes security events using the clustering analysis and the cause and effect analysis concurrently, it builds a correlating state machine in the memory for every attack scenario, traces and records the developing of the attack activity. It is more timely and accurately to analyze the security events using this technology. At last, using the DARPA2000 intrusion scenario specific data sets to validate the technology.

关 键 词：入侵场景重构 聚类分析 因果分析 攻击场景树 关联状态机 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]