基于数据挖掘和本体的入侵警报关联模型  

Intrusion alert correlation model based on data mining and ontology

作　　者：任维武[1] 胡亮[1] 赵阔[1] 

机构地区：[1]吉林大学计算机科学与技术学院,长春130022

出　　处：《吉林大学学报（工学版）》2015年第3期899-906,共8页Journal of Jilin University:Engineering and Technology Edition

基　　金：国家自然科学基金项目(60873235);新世纪杰出人才项目(NCET-06-0300);吉林省科技发展计划项目(20080318)

摘　　要：为了突破入侵检测领域的原有瓶颈,提出了一种新的基于数据挖掘和本体的入侵警报关联模型。该模型通过对底层警报的聚类和分类,发现并且筛选攻击,然后根据已建立的基于本体的攻击知识模型,对这些攻击进行关联,以达到识别、跟踪和预测多步攻击的目的。通过对KDD Cup1999和DARPA 2000数据集的模拟实验,验证了模型的有效性。With the gradual development of network application fields, the attack patterns have reached their delicacy and multi-steps from the coarse and simplistic pattern in their early days. In order to redeem the flaws of intrusion detection technology, an intrusion alert correlation model based on data mining and ontology （IACMDO） is proposed. IACMDO deals with underlayer alert through cluster and classification, and builds attack knowledge model by ontology, realizing the detection, tracing and predicting against multi-steps attack. The performance of traditional IDS is upgraded through simulations of KDD Cup 1999 and DAPRA 2000 datasets, which verifies the efficiency of the proposed alert correlation model.

关 键 词：计算机工程 入侵检测 入侵警报关联 数据挖掘 本体 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]