基于威胁度的动态报警管理研究

IDS目前的主要问题之一是过高的误报率,这一方面给管理员增加了繁重的工作负担,从而使其可能忽视了系统中真正需要处理的关键攻击事件;另一方面,过高的误报率使得自动入侵响应,比如与防火墙联动,不能很好地执行下去.针对这个问题,提出了基于威胁度的动态报警管理TDAM模型,它通过对系统环境的感知分析报警信息,确定其威胁度.通过实验,可以得出TDAM框架能够比较好地进行报警评价、管理.

Research on Threat-based Dynamic Alerts Management

One of the primary issues of IDSes is excessive false positives.This adds heavy burden to the system manager,which may lead the essential attacks to be ignored,and lead the automated intrusion response,e.g.cooperating with firewalls,can't carry out well.To resolve these issue,this paper presents a TDAM(Threat-based Dynamic Alerts Management)model.It analyzes alerts by apperceiving the system environment to specify the alerts' threat.A conclusion can be drawn from the experiment that the TDAM model can well apply in alerts evaluation and management.