基于场景重构和报警融合的异常数据分析  

作　　者：周广刚[1,2] 尉永清[3,2] 

机构地区：[1]山东师范大学信息科学与工程学院,山东济南250014 [2]山东省分布式计算机软件新技术重点实验室,山东济南250014 [3]山东警察学院公共基础部,山东济南250014

出　　处：《科技视界》2015年第15期7-7,163,共2页Science & Technology Vision

摘　　要：本文提出了一种包含报警标准化、去冗余、场景重构和报警融合的异常数据分析方法 ,通过去除攻击失败的报警,减少了对场景重构的干扰。在场景重构中,通过反向关联,减少了不必要的报警,同时通过对孤立报警的补充,保证了场景图的完整性。在报警融合中,提出了融合同一攻击步骤的不同报警的方法,以抽象层和具体层两个层次重构入侵场景。最后通过实验验证了所提出方法的有效性。This paper proposes an abnormal data analysis method which contains alarm standardization, eliminating redundancy, scene reconstruction and alarm fusion . The interference of scene reconstruction is reduced by removing the alarm of failed attacks. In the reconstruction of the scene, through reverse link, reduced the unnecessary evidence, at the same time through the addition to the isolated alarm, to ensure the integrity of the scene graph .Herein, to reconstruct intrusion scenario in abstract and concrete layer, we also developed different alerting methods based fusion of the same attack steps in the alarm fusion. Finally the effectiveness of the proposed method is verified by experiment.

关 键 词：异常数据分析 去冗余 场景重构 报警融合 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]