采用攻击策略图的实时警报综合分析方法

针对警报因果关联分析方法存在攻击场景图分裂且无法及时处理大规模警报的问题，提出并实现一种采用攻击策略图的实时警报综合分析方法．首先，通过在警报关联过程中引入推断警报环节避免攻击场景图的分裂；然后，采用一种新型滑动窗口机制，为每类攻击创建一个滑动窗口，并结合时间跨度与警报数量设定窗口大小，在保证关联效果基础上具有线性时间复杂度；最后，将该方法扩展为包含实时攻击场景重构、后续警报推测及分析结果融合的综合警报分析系统．实验结果证明了该方法的实际有效性和高效性．

Comprehensive analysis of real-time alerts with attack strategy graphs

The causal relation based alert correlation approach causes split scenario graphs and cannot process massive alerts in time. To address this issue, a comprehensive analysis approach of real-time alerts with attack strategy graphs is proposed. First, it gets rid of the splitting of the attack scenario graph by introducing hypothesizing alerts to the alert correlation process. Second, it leverages a novel sliding window mechanism, which maintains a window for each type of attacks and determines the window's size according to both the time and number of the alerts. This new mechanism only introduces linear time complexity without sacrificing effectiveness. Third, the approach is extended to a comprehensive system to reconstruct attack scenarios, predict future alerts and fuse analytical results. Evaluation results indicate that our approach is effective and efficient.