基于可疑队列的多源攻击图入侵检测方法

发布时间：2018-04-04 11:46

本文选题：入侵检测系统　切入点：多源警告　出处：《计算机工程与设计》2017年06期

【摘要】：现在大部分针对IDS警告的因果关联分析、攻击图等入侵检测方法,在警告有大量误报、漏报时不能够很好地进行攻击场景还原。针对该问题,提出使用来源于多种设备的警告日志进行入侵检测的方法,将多种设备日志进行关联分析,构建包含大量攻击场景的攻击图。攻击图中每个攻击场景包含来源于不同设备的警告,每当有新警告产生时,将该警告与攻击图中场景匹配,发现新的攻击过程。实验结果表明,该方法在进行攻击场景还原,尤其是在IDS警告有大量误报、漏报的情况下,攻击场景的还原率明显高于其它同类检测方法。
[Abstract]:Now most of the intrusion detection methods such as causality analysis and attack graph for IDS warnings have a large number of false positives and can not restore the attack scenes well when they fail to report.To solve this problem, an intrusion detection method based on warning logs from multiple devices is proposed, which is associated with various device logs, and an attack graph containing a large number of attack scenarios is constructed.Each attack scene in the attack diagram contains a warning from a different device. Whenever a new warning is generated, the warning is matched with the scene in the attack diagram to discover the new attack process.The experimental results show that the reduction rate of the attack scenario is significantly higher than that of other similar detection methods, especially when the IDS warning has a large number of false positives and the false positives are not reported.
【作者单位】：中国民航大学计算机科学与技术学院;中国民航大学信息安全测评中心;
【基金】：民航局科技基金项目(MHRD20140205、MHRD20150233);民航局安全能力建设基金项目(PDSA0008) 中央高校基本科研业务费中国民航大学专项基金项目(3122013Z008、3122013C004、3122015D025) 中国民航大学科研启动基金项目(2013QD24X)
【分类号】：TP393.08

【相似文献】