入侵响应中基于事件相关性的攻击预测算法

目前的入侵检测系统(IDS)中的响应单元只对检测出的当前安全事件做出响应,而忽略了攻击事件间隐藏的关系及攻击的最终目的。本文针对上述问题在IDS的响应单元中提出了一个利用攻击事件间的相关性对攻击的最终目的进行预测的算法。实验证明该算法提高了网络的预警能力,减少了对误报的响应,并能发现分析引擎的漏报情况。

An Attack Predictive Algorithm Based on the Correlation of Intrusions Alerts in Intrusion Response

Traditional intrusion detection systems(IDSs)take actions to the alerts independently, and ignore the logi- cal connections between them. In this paper an attack predictive algorithm in intrusion response part of the IDS is pre- sented based on the prerequisites and consequences of intrusions. And an off-line simulation experiment shows that it can improve the prediction ability of the IDS, and reduce the false alert and find the potential attack.