一种基于警报数据关联的入侵检测系统模型

入侵检测是保障网络安全的重要手段。对入侵检测系统产生的警报信息进行关联分析已经成为改善入侵检测系统检测性能的一个重要的、实际可行的手段。本文提出了一种分布式入侵检测警报数据关联模型,模型通过警报数据聚类和高层事件关联消除或减少重复警报,降低误警率,发现高层攻击策略。最后给出了警报聚类关联实现算法,该算法通过警报数据相似度的计算来实现警报聚类。

An IDS Model Based on Alert Correlation

Intrusion detection is an important method to ensure network security. Alert correlation has been an important,practical and feasible approach to improving the detection capability of IDSs. This paper proposes an alert correlation model for distributed intrusion detection system,which can reduce repeated alerts and false alerts,and discover the high level attack policy. Based on this model,an alert cluster algorithm is proposed,which accomplishes clustering by calculating the alert similarity degree.