基于因果关系的分层报警关联研究

发布时间：2018-05-28 07:12

本文选题：报警关联 + 报警聚类　；参考：《计算机应用研究》2016年03期

【摘要】：入侵检测系统产生海量报警数据,造成报警关联时间长、关联结果结构复杂、难以理解。针对上述问题,提出一种基于因果关系的分层报警关联模型。该模型先根据攻击目标聚类报警,在因果关系的指导下以单步攻击作为节点构建主机层攻击路径,定义单步攻击相似度和攻击模式相似度,通过拓扑排序合并主机层攻击路径的相似节点得到攻击模式,计算攻击模式相似度实现预警,并以受害主机作为节点从空间上构建更高层面的网络层攻击场景。实验表明,分层关联结果结构简洁,有助于识别攻击策略、指导安全响应,而且先聚类后关联的方法能够有效提高报警关联效率。
[Abstract]:Intrusion detection system (IDS) produces a large amount of alarm data, which results in a long time of alarm association, complex structure and difficult to understand. To solve the above problems, a hierarchical alarm correlation model based on causality is proposed. Under the guidance of causality, the model constructs the host layer attack path based on the attack target clustering alarm, and defines the similarity of single-step attack and attack pattern. The attack pattern is obtained by combining the similar nodes of the host layer attack path by topological sorting, and the attack pattern similarity is calculated to realize the early warning, and the injured host is used as the node to construct a higher level network layer attack scene from the space. The experimental results show that the hierarchical association results are simple in structure, help to identify attack strategies and guide security responses, and the method of clustering before association can effectively improve the efficiency of alarm association.
【作者单位】：上海交通大学信息安全工程学院;广西财经学院信息与统计学院;广西财经学院管理科学与工程学院;
【基金】：国家自然科学基金资助项目(61431008;61562004) 高等学校博士学科点专项科研基金资助项目(20130073130006) 广西自然科学基金资助项目(2013GXNSFBA019274) 广西高等学校高水平创新团队及卓越学者计划资助项目广西高校科研项目(2013YB214)
【分类号】：TP393.08

【参考文献】