基于自扩展时间窗的告警多级聚合与关联方法

发布时间：2018-03-12 19:32

本文选题：攻击检测　切入点：告警聚合　出处：《工程科学与技术》2017年01期 　论文类型：期刊论文

【摘要】：针对传统告警聚合与关联方法在合理性和准确性上的不足,提出了基于多级划分思想的告警聚合方法和基于马尔可夫链模型的告警关联方法。首先,使用入侵检测消息交换格式来描述网络告警,利用告警的时序接近关系进行时间窗口的自动扩展,将时间间隔小于预设阈值的告警划分到同一个时间窗内;进而,分别根据攻击类型、时间窗口、子网掩码、IP地址和端口信息依次划分告警,利用属性匹配方法进行子网级、主机级和服务级聚合,有效聚合攻击者利用同一路由器、傀儡主机或服务端口实施攻击而产生的相似告警;在此基础上,利用1阶马尔可夫链模型生成告警关联图,将攻击类型间的条件转移概率作为关联图的有向边,并利用告警的时序紧邻关系计算出攻击类型间的转移概率。实验中,利用入侵检测系统Snort的最严格模式处理DARPA2000流量数据,得到LLDo S1.0攻击场景所对应的入侵告警集合;利用本文方法对集合中的5类告警进行聚合和关联,通过参数寻优得到自扩展时间窗口最理想的间隔阈值,使得告警多级聚合结果能够有效精简告警,并与告警源IP和源端口的分布情况一致;通过比较告警关联结果与攻击场景的官方描述来计算告警关联的准确率。与传统方法进行对比,本文方法的告警关联准确率为97.94%,比传统方法提高了2.29%。
[Abstract]:Aiming at the shortcomings of the traditional alarm aggregation and correlation methods in rationality and accuracy, the alarm aggregation method based on multilevel partitioning and the alarm association method based on Markov chain model are proposed. The intrusion detection message exchange format is used to describe the network alarm, and the timing proximity relation of the alarm is used to extend the time window automatically, and the alarm with the interval less than the preset threshold is divided into the same time window. According to attack type, time window, IP address and port information of subnet mask, alarm is divided in turn, subnet level, host level and service level are aggregated by attribute matching method, and attackers are effectively aggregated by the same router. Based on the similar alarm generated by attacks by puppet hosts or service ports, the alarm correlation graph is generated by using the first-order Markov chain model, and the conditional transfer probability between attack types is regarded as the directed edge of the correlation graph. In the experiment, the intrusion detection system (Snort) is used to process the DARPA2000 traffic data, and the intrusion alarm set corresponding to the LLDo S1.0 attack scene is obtained. In this paper, five kinds of alarms in the set are aggregated and correlated, and the optimal interval threshold of the self-expanding time window is obtained by parameter optimization, so that the alarm multi-level aggregation results can effectively reduce the alarm. It is consistent with the distribution of alarm source IP and source port, and the accuracy of alarm association is calculated by comparing the results of alarm association with the official description of the attack scene. The alarm correlation accuracy of this method is 97.94, which is 2.29% higher than the traditional method.
【作者单位】：海军工程大学信息安全系;
【基金】：国家自然科学基金资助项目(61672531) 湖北省自然科学基金资助项目(2015CFC867)
【分类号】：TP393.08

【相似文献】