分布式入侵告警关联分析

为了精简分布式入侵检测系统中重复性的、不完善的或不完整的告警数据，降低误告警率，解决具有因果关系和非因果关系共存的告警关联问题，提出了一种分级关联算法．利用告警数据的检测时间属性的接近度将关联分析分为两类：概率关联和因果关联．给出了自调节增量贝叶斯分类器和实时因果关联算法，从而实现了多种特征混合的告警关联，提高了告警关联率．使用MIT Lincoln Lab提供的2000 DARPA入侵检测攻击场景数据集LLDOS1．0对该算法进行了性能测试，实验结果验证了算法的有效性．

Correlation Analysis for Distributed Intrusion Alert

In order to reduce duplicated or incomplete or unperfect alerts in distributed intrusion detection systems and false alert rate, so as to solve alert correlation mixing prerequisites and consequences of intrusions with characteristic similarity of intrusions, a hierarchical correlation algorithm is presented in this paper. Based on the detect time similarity, alert correlation analysis is divided into two class: probabilistic correlation and consequence correlation. Adjustable increment Bayesian classifier and real-time correlation algorithm based on prerequisites and consequences of intrusions are given. As a result, alert correlation mixing multi-character is implemented and the alert correlation rate is improved. 2000 DARPA LLDOS1.0 from MIT Lincoln Lab is used to evaluate the hierarchical correlation algorithm, and the experiment results show the efficiency of the algorithm.