一种基于节点关联的报警置信度计算方法  

Calculation method for alert credibility based on peer correlation

作　　者：周芳[1] 于真[2] 郑雪峰[1] 

机构地区：[1]北京科技大学计算机与通信工程学院,北京100083 [2]北京物资学院信息学院,北京101149

出　　处：《北京科技大学学报》2011年第11期1424-1429,共6页Journal of University of Science and Technology Beijing

摘　　要：大部分入侵检测系统的实现都会产生大量的报警信息,在一定程度上影响了系统管理,误报率也较高,影响了入侵检测的效果.针对这个问题,提出了一种基于节点关联的报警置信度计算方法,位于对等网络之上,节点在收到一系列入侵报警之后,需要进行节点关联,从而对报警信息进行融合,提取有效报警信息.其中根据关联对象的不同,节点关联又包括报警关联和信任关联两个层次,报警关联可用来判断入侵报警的有效性,信任关联可用来判断发起报警节点的可信性,给出了相关算法.仿真实验表明,使用该报警置信度计算方法可以提高入侵报警的检测准确率.Most intrusion detection systems produce large amounts of alert information,which affect system management to some extent and lead to high misstatement rate,and thereby influence the intrusion detection.To solve this problem,a calculation method for alert credibility based on the peer correlation is proposed over P2P overlay networks,where peers need the association after receiving a series of intrusion alarm to integrate the alarm information and extract the effective alarm information.According to different associated objects,the peer correlation includes the alert correlation and the trust correlation.The effectiveness of intrusion alert information can be judged through the alert correlation,and the credibility of the peer producing the alarm can be measured through the trust correlation.A correlation algorithm is also given.Simulations show that the dual correlation algorithm can improve the accuracy of intrusion detection alerts.

关 键 词：入侵检测 报警 关联方法 对等网络 网络安全 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]