基于攻击图与报警相似性的混合报警关联模型  

Hybrid model of alert correlation based on attack graph and alert similarity

作　　者：朱梦影 徐蕾[1] 

机构地区：[1]沈阳航空航天大学计算机学院,沈阳110136

出　　处：《计算机应用》2014年第1期108-112,共5页journal of Computer Applications

摘　　要：为了揭示入侵检测系统所生成的报警数据之间的关联关系和重构入侵攻击场景,提出了一种基于攻击图与报警数据相似性分析的混合报警关联模型。该模型结合攻击图和报警数据分析的优点,首先根据入侵攻击的先验知识定义初始攻击图,描述报警数据间的因果关联关系,再利用报警数据的相似性分析修正初始攻击图的部分缺陷,进而实现报警关联。实验结果表明,混合关联模型能够较好地恢复攻击场景,并能够完全修复攻击图中单个攻击步骤的缺失。In order to reveal logic attack strategy information from alarms generated by intrusion detection system and reconstruct attack scenario, a hybrid model of alarm correlation was proposed, which was based on attack graph and alert similarity analysis. This model combined the advantages of attack graph and alert data analysis. First of all, it described the causal relationship between alarms, according to the initial attack graph defined by the prior knowledge of intrusion attack. Afterwards, it used the similarity analysis of the alert data to repair the defects of the initial attack graph. And then it implemented alert correlation. The experimental results show that the model can not only recover attack scenario but also be able to fully repair the attack graph in the absence of a single attack step.

关 键 词：报警关联 入侵场景 攻击图 报警相似性 关联模型 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]