一种入侵检测警报关联分析方案设计  

A scheme design of intrusion detection alert correlation analysis

作　　者：张冬芳[1] 张茹[2] 李斯祺 Zhang Dongfang;Zhang Ru;Li Siqi(The First Research Institute of the Ministry of Public Security,Beijing 10048;Beijing University of Post and Telecommunications,Beijing 100876)

机构地区：[1]公安部第一研究所,北京100048 [2]北京邮电大学,北京100876

出　　处：《网络空间安全》2018年第6期26-29,共4页Cyberspace Security

摘　　要：针对当前入侵检测的攻击警报误报率高、关联性差的问题,设计一种基于多维度的IDS警报误报消除算法,利用粗糙集理论设计一种新型警报聚合算法,通过改进警报因果关联算法,提出新型警报关联算法,简化原有关联算法的复杂度,提高警报关联的效率,为持续性网络攻击(如APT攻击)分析提供数据支撑。Aiming at the problems of high false alarm rate and poor correlation of attack alerts in intrusion detection, a multi-dimension IDS false alarm cancellation algorithm is designed, a new alarm aggregation algorithm is designed based on rough set theory, and a new alarm association algorithm is proposed based on the improving causal association algorithm, which makes the original association algorithm simpler and more effective. The new association algorithm can provide the data support for the APT attacks.

关 键 词：误报消除 关联分析 聚合算法 

分 类 号：TP393.0[自动化与计算机技术—计算机应用技术]