利用模糊聚类实现入侵检测告警关联图的重构

众多的入侵检测告警关联方法中,因果关联是最具代表性的方法之一。针对因果关联在一些条件下会引发关联图分裂的问题,提出利用模糊聚类的方法实现攻击场景重构。在聚类过程中,针对告警特性提出一种基于属性层次树的相似度隶属函数定义方法,并给出评价相似度度量和衡量攻击场景构建能力的若干指标。实验结果表明,该方法能够有效地组合分裂的关联图,重构攻击场景。

Using fuzzy clustering to reconstruct alert correlation graph of intrusion detection

Causal correlation method was one of the most representative methods for instruction detection alert correla-tion. In some conditions, the correlation graph would be split because of loss of causal information. In order to solve the problem, an algorithm was proposed to reconstruct attack scenario using fuzzy clustering. A new similarity membership function based on the attribute hierarchy tree was defined in the process of clustering. Furthermore, the evaluation method and indexes were put forward to describe the ability of reconstructing attack scenario. The experimental results indicate that this algorithm is valid to combine the split correlation graph and reconstruct attack scenario.