基于推理模型的报警关联分析方法  

IDS Alerts Correlation Analysis Based on Reasoning Model

作　　者：任肖肖[1] 罗军勇[1] 尹美娟[1] 何升[1] 

机构地区：[1]信息工程大学,河南郑州450001

出　　处：《信息工程大学学报》2015年第4期483-487,共5页Journal of Information Engineering University

摘　　要：入侵检测系统(IDS)存在着报警重复、报警信息层次低、对设备的依赖性较强等问题。提出了一种基于推理模型的报警关联分析方法,通过建立语义映射和推理模型,对报警信息进行关联分析,生成报警关联图,构建攻击场景。实验表明,该方法构建的攻击场景图能够准确反映当前网络面临的安全威胁,为进一步的网络安全威胁态势感知工作提供了很好的指导。With the development of Internet technology and social information, network security is increasingly serious. In order to maintain the normal operation of the network, a lot of security de- vices are used, and the most widely used one is IDS. It has a great detection performance, hut the problem is it has a huge scale of low level alerts, and may describe just a step of attack. Meanwhile, some existing attacks correlation analysis methods for IDS alerts has a strong dependence on the IDS which leads to difficulty for its wide use. This paper proposes a new method for conducting alert correlation based on a simple and direct semantic model for IDS alerts. The correlation model is sepa- rate from the semantic model and can be constructed on various granularities. The proposed method is evaluated on a number of publicly available data sets, and the result shows that our correlation method can correctly capture almost all the attack scenarios in the data sets.

关 键 词：入侵检测 推理模型 攻击场景 态势评估 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]