基于空间和时间密度的入侵报警聚合研究  

Research of Intrusion Alert Aggregation Based on Spatial and Temporal Density

作　　者：张靖[1] 王衡军[1] 李俊全[1] 郁滨[1] 

机构地区：[1]解放军信息工程大学,河南郑州450004

出　　处：《系统仿真学报》2016年第6期1336-1343,共8页Journal of System Simulation

摘　　要：针对分布式入侵检测系统在实际应用中存在大量重复报警和高误报率的问题,在研究DBSCAN算法的基础上,引入时间密度,提出一种基于空间和时间密度的抗噪声聚合算法(DBS&TCAN)。基于空间密度聚合局部报警信息和时间密度对局部聚合结果进行合并,可以有效减少重复报警并降低误报率。实验采用数据集测试的方法对算法进行了测试,并与相关研究工作进行比较和分析。结果表明,该算法具有较好的聚合效果,并在实时性方面体现出优势。Distributed Intrusion Detection System has created the problem to investigate a mass of duplicate alerts and high false positive rate in practical applications. Based on DBSCAN, density based spatial and temporal clustering of applications with noise（DBSTCAN） algorithm was proposed by introducing temporal density. The approach aggregated partial alerts based on spatial density, and merges partial aggregation on the basis of temporal density. The effectiveness of the algorithm was demonstrated by the intrusion detection evaluation dataset. The comparative experiments and analysis show that the algorithm is effective in alert aggregation and gives better results in terms of real time.

关 键 词：入侵检测系统 报警聚合 时间密度 DBSCAN DBS&TCAN 实时性 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]