基于多源安全信息的IDS告警验证研究

由于检测算法的不足以及对目标系统相关信息的忽视，当前的入侵检测系统（IDS）存在着告警泛滥、误报率高等不足，影响了应用效果。为解决这些问题，在对现有验证算法不足进行分析的基础上，提出了一种利用多源安全信息进行告警验证的方法。通过利用深度漏洞信息、系统状态监测信息等多源安全信息，根据相应的告警验证算法，对IDS原始告警信息进行验证。相关实验证明了该方法的有效性。

IDS alert verification based on multi-source security information

Due to the design flaws and the ignorance of the target system's information, there exist several shortages in the current intrusion detection systems, such as alert overload and high false alarm rate. To solve these problems, based on the analysis of the current alert verification algorithms, a new alert verification algorithm has been presented in this paper. By utilizing the multi source security information including vulnerability information, system security log and the system state inspection information, the raw IDS alert information generated by the intrusion detection system can be verified and filtered according to the verification algorithm. Experimental results have demonstrated the effectiveness of the verification algorithm.