一种基于凝聚度的报警处理算法  

Cohesion Based Algorithm to Manage IDS Alerts

作　　者：黄金垒 王衡军[1] 郁滨[1] Huang Jinlei Wang Hengjun Yu Bin(PLA Information Engineering University, Zhengzhou 450004, Chin)

机构地区：[1]解放军信息工程大学,河南郑州450004

出　　处：《系统仿真学报》2017年第4期859-864,共6页Journal of System Simulation

摘　　要：在研究分类系统和语义相似度的基础上,给出了簇的凝聚度的概念,提出了一种基于凝聚度的报警处理算法。算法以凝聚度为基础,利用改进的二分K均值算法聚合报警,并对聚合结果进行异常提取。实验结果表明,提出的算法能有效聚合大量报警、发现异常报警,且聚合结果具有良好的语义和较高的准确性。On the basis of intrusion taxonomies and semantic similarity, the concept of cluster cohesion as well as an algorithm was proposed to manage IDS alerts. Based on cohesion, the proposed approach used improved bisecting K-means to aggregate massive alerts, and extracted the abnormal alerts from clusters formed in aggregation. The experimental results show that the approach is effective in alerts aggregation and abnormal alerts detecting, and can generate understandable meta-alerts with higher accuracy.

关 键 词：报警聚合 异常提取 语义相似度 凝聚度 改进二分K均值 

分 类 号：TP309.1[自动化与计算机技术—计算机系统结构]