一种基于数据挖掘的多步入侵警报关联模型  

An Intrusion Alert Correlation Model Based on Data Mining

作　　者：于潇菂[1] 努尔布力[2] 胡亮[1] 解男男[1] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130012 [2]新疆大学信息科学与工程学院,乌鲁木齐830046

出　　处：《吉林大学学报（理学版）》2013年第5期881-886,共6页Journal of Jilin University:Science Edition

基　　金：国家自然科学基金(批准号:61073009;61163052);国家重点基础研究发展计划973项目基金(批准号:2009CB320706);国家高技术研究发展计划863项目基金(批准号:2011AA010101);新疆大学博士启动基金(批准号:BS110126)

摘　　要：基于传统网络入侵检测系统,提出一种基于数据挖掘的多步入侵警报关联模型.该模型能将多个入侵检测系统的警报信息进行融合,对大量、无序的警报信息进行分析,发现其中的内在联系,精简攻击事件警报,并通过不断更新场景知识库发现融合后警报中的多步入侵行为.与已有模型进行对比的结果表明,该模型的关联分析方法及多步入侵知识库的建立有助于更好地结合系统的特征实现多步入侵的警报关联.According to the researches of traditional network intrusion detection, we proposed a multi- step intrusion alert collaborative model based on data mining, by which the alert information of several intrusion detection systems can be integrated so as to find the inner contacts by analysing the massive, disordered alert information, the attack alert can be simplified, and the multi-step intrusion in the integrated alert information can be found through the constantly updated knowledge database. Comparison of the model with the existing model shows that the correlation analysis method of this model and the build of the multi-step intrusion knowledge base really do help to the combination of the characteristics of different systems so as to realize multi-step intrusion alert collaborative researches.

关 键 词：数据挖掘 异常检测 多步入侵 警报关联模型 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]