运用警报关联的威胁行为检测技术综述  

Survey of alert-correlation based on network threat detection techniques

作　　者：王意洁[1] 程力 马行空 WANG Yijie;CHENG Li;MA Xingkong(National Key Laboratory for Parallel and Distributed Processing, College of Computer,National University of Defense Technology, Changsha 410073 , China;Department of Network Engineering, College of Computer, National University of Defense Technology, Changsha 410073 , China)

机构地区：[1]国防科技大学计算机学院并行与分布处理重点实验室,湖南长沙410073 [2]国防科技大学计算机学院网络工程系,湖南长沙410073

出　　处：《国防科技大学学报》2017年第5期128-138,共11页Journal of National University of Defense Technology

基　　金：国家自然科学基金资助项目(61379052);国家863计划资助项目(2013AA01A213);湖南省自然科学基金杰出青年基金资助项目(14JJ1026);高等学校博士学科点专项科研基金资助课题(20124307110015)

摘　　要：基于警报关联的网络威胁行为检测技术因其与网络上大量部署的安全产品耦合,且能充分挖掘异常事件之间的关联关系以提供场景还原证据,正成为复杂威胁行为检测的研究热点。从威胁行为和网络安全环境的特点出发,引出威胁行为检测的应用需求和分类,介绍基于警报关联的威胁行为检测的基本概念和系统模型;重点论述作为模型核心的警报关联方法,并分类介绍了各类典型算法的基本原理和特点,包括基于因果逻辑的方法、基于场景的方法、基于相似性的方法和基于数据挖掘的方法;并结合实例介绍了威胁行为检测系统的三种典型结构,即集中式结构、层次式结构和分布式结构;基于当前研究现状,提出了对未来研究趋势的一些认识。The rapid development of the Internet also causes more and more network threats.How to detect the network threats in a real-timeand accurate manner becomes one of the key technique issues.The alert-correlation-based network threat detection technique is becoming theresearch hotspot,which couples with the widely used security products and fully exploits the relation between abnormal events to reconstruct theattack scenario.Starting from the features of network threats and security environment,the requirements and classification of network threatdetection were introduced.Then the basic concepts and system model of alert-correlation-based network threat detection technique were illustratedin detail.The key module of the model,alert correlation method,and the fundamentals and features of different kinds of typical algorithm werestudied in detail,including causal-relation-based method,case-based method,similarity-based method and data-mining-based method.Furthermore,three kinds of representative detection system architectures were discussed with practical instances,namely centralized architecture,hierarchical architecture and distributed architecture.Finally,based on the analysis of recent research work,the future work is discussed andoutlined.

关 键 词：威胁行为检测 警报关联 检测模型 检测系统结构 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]