网络态势感知中的报警记录觉察研究  

Research on Alert Records Perception of Network Situation Awareness

作　　者：王娟[1] 彭静[2] 王灿[3] 

机构地区：[1]成都信息工程学院网络工程学院,四川成都610225 [2]成都信息工程学院教务处,四川成都610225 [3]电子科技大学计算机科学与工程学院,四川成都610054

出　　处：《计算机工程与科学》2012年第7期39-45,共7页Computer Engineering & Science

基　　金：成都信息工程学院科研基金资助项目(KYTZ201121)

摘　　要：网络态势感知中的报警觉察在处理粒度、规模、目标等方面均不同于传统入侵检测中的报警分析,更加侧重于人的理解。本文在现有基于相似度报警分析方法的基础上设计了一种"基于相似度的宏观网络报警觉察算法",重新定义了报警属性相似度,将"优序对比法"引入属性权重设定,最后提出以"人的瞬时理解力"为依据的阈值选择方案。实验显示该方法能帮助网络管理人员从整体上把握网络异常的时间、范围、类型,理解网络的态势。The alert perception of network situation awareness is different from that of the traditional intrusion detection area in particle size, scale, target, and so on. It pays more attention to human under- standing. Based on the existing similarity based alert analysis method, a ＂similarity based macro net- work alert awareness algorithm＂ is proposed. It gives a new definition of attribute similarity, and uses an ＂optimal sequence method＂ to improve attribute weight setting. Finally, a threshold selection scheme is proposed based on human instantaneous understanding. The experimental results show that this method can help network managers get the whole awareness of network situation including the time, range, and type of network abnormality.

关 键 词：网络态势感知 报警分析 入侵检测 相似度 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]