可信物联网虚拟化数据中心数据融合结果检测技术研究  

RESEARCH ON DATA FUSION RESULTS DETECTION TECHNOLOGY IN TRUSTED INTERNET OF THINGS VIRTUALIZED DATA CENTER

作　　者：张娜 ZHANG Na(College of Artificial intelligence,Henan Finance University,Zhengzhou 450046,China)

机构地区：[1]河南财政金融学院人工智能学院,郑州450046

出　　处：《内蒙古农业大学学报（自然科学版）》2020年第4期70-75,共6页Journal of Inner Mongolia Agricultural University(Natural Science Edition)

基　　金：河南省科技攻关计划项目(172102210105);河南省高等学校重点科研项目(17A520024);平顶山市科技攻关项目(2017009(9.4));河南青年骨干教师资助项目(2019GGJS225);河南省教育厅青年骨干教师资助项目(2019GGJS225)。

摘　　要：本研究针对无线传感器网络的结构特性,通过把互联网数据融合技术以及无线传感器网络相连接,从而得到可信物联网虚拟化数据中心数据融合检测技术,并且对于其进行试验研究并分析结果,研究方向主要是从入侵检测系统进行,由于该系统技术发展尚未完善,因而对其使用数据融合技术,设计了相关入侵检测报警数据融合模型,对来自不同检测代理的报警采用模块化处理方式进行分层处理。而在关于代理本地的检测工作中,主要是它能够给对于各个IDS所具有的报警特征的差异情况,对于其中包含的重复报警情况进行消除工作,同时对各个IDS的报警格式统一化处理,将实现处理好的报警信息传输到系统中心控制模块,而后实时发送;对于报警信息进行重复消除和统一处理,可以通过利用各个报警信息其属性特征相似的原理进行信息数据的融合处理,并且从中分析判断每个报警信息之间存在的关联性,采用因果关联和基于攻击意图分析方法,将安全策略和报警信息相联系,结合配置信息和系统脆弱性对入侵行为进行关联分析。在同一个IDS产生的原始报警中,重复报警现象确实大量存在;通过融合,各个IDS所传输的报警信息并没有出现任何损失,同时报警信息也是实时传递,可以很好地降低报警失误性和解决大批次的报警问题,均取得较好的效果。According to the characteristics of wireless sensor network,this research combines data fusion technology with wireless sensor network,and studies the detection technology of data fusion results in virtual data center of trusted Internet of Things.In view of the shortcomings of intrusion detection system,data fusion technology is applied in intrusion detection system,and an intrusion detection and alarm data fusion model is designed.The alarms of different detection agents are processed hierarchically by modularization.In the detection agent locality,according to the alarm attributes of each IDS,the repetitive alarm is eliminated and the alarm format is unified.First,the processed alarm information is sent to the central console for real-time transmission.The attribute similarity algorithm is used to fuse the alarm information and judge the correlation between alarms.Causal and causal correlation and attack intention-based analysis method are used to link the security strategy with the alarm information.Combining configuration information and system vulnerability,the intrusion behavior is analyzed.In the original alarm generated by the same IDS,the phenomenon of repeated alarm does exist in a large number;through integration,the main information of the alarm is not lost,and the timeliness of the alarm continues to be maintained,which achieves better results in solving the problem of high false alarm rate and mass alarm.

关 键 词：虚拟化 数据融合 检测 报警 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]