利用关联和风险评估方法减少误报和漏报 *

高误报和漏报率是入侵检测系统面临的主要问题。提出了一种利用关联和风险评估的方法 ,利用构建的安全关联模型 ,计算出每个安全事件 (如告警事件、系统安全日志记录等 )的实时风险值 ,对风险值较高的事件给出新的警告 ,并摈弃那些风险值较低的事件 ,从而降低漏报和误报率。实验结果表明 ,利用这种方法实现的事件关联系统能够显著降低检测系统的误报和漏报率。

Reducing false positive and false negative by correlation and risk assessment

The main problems facing intrusion detection systems are high false positive rate and false negative rate. This paper proposed a correlation and risk assessment approach to solve these problems, which exploited constructed security correlation model to compute real-time risk for every security event( such as alert, operating system log record, and so on) , and gave out new alerts for high risk events while discard low risk ones so as to reduce false positive and false negative rate. The initial test results of event correlation system show that this approach dramatically reduces the rate of false positive and false negative rate of intrusion detection systems.