基于贝叶斯网络的攻击事件智能发掘模型

针对目前传统入侵检测系统难以得出网络攻击行为之间存在的关联关系问题，以攻击图表示模型为指引，提出一种基于贝叶斯网络的攻击事件智能发掘模型。本文以先验知识建立贝叶斯攻击行为关联图。基于属性相似度聚合网络攻击行为，针对网络攻击场景设计高效的Ex-Apriori算法发掘攻击行为间的关联规则，并建立攻击行为组集。利用贝叶斯攻击行为关联图的参数对攻击行为组集进行计算，实现对攻击事件的发掘。实验表明，本模型能有效提取网络攻击事件及发现攻击路径，为网络攻击事件的发现与应对措施提供理论支持和技术支撑。

Intelligent mining model of attack events based on Bayesian network

It is difficult for traditional intrusion detection systems to obtain the relationship among network attack behaviors. Taking an attack graph representation model as a guide, an intelligent mining model of attack events based on Bayesian network is proposed. A Bayesian attack association graph is established based on prior knowledge. The network attack behaviors are aggregated based on attribute similarity. An efficient Ex-Apriori algorithm is designed for network attack scenarios to discover the association rules among the attack behaviors, and the attack behavior group set is established. Finally, the attack behavior group set is calculated by using the parameters of the Bayesian attack association graph to realize the discovery of attack events. Experiments show that this model can effectively extract network attack events and discover attack paths, and provide theoretical and technical support for the discovery and countermeasures of network attack events.