入侵告警关联系统及关键技术的研究

入侵检测系统的大部分攻击事件之间都存在某种联系,通过对这些告警的关联分析能够减少告警数量,降低误报率,更好地发现攻击以及动态地监控网络。论文提出了一种告警关联系统,系统包括聚合分析、告警确认、多步攻击关联分析和告警严重度分析等过程。文章还对系统中两种主要方法—步攻击关联进行了描述。

Study of Framework and Key Technology for Intrusion Alerts Correlation

The attack events aimed at one system are usually inter-connected in certain respects.Through the correla-tion to discover the attack events' inter-connection,the system can detect the attacks more accurately and dynamically,in terms of decreased number of alerts accuracy and decreased false positive rate.This paper presents an intrusion alerts correlation framework,which is mainly composed of four parts,aggregation analysis,alerts verification,multi-step attack correlation and impact analysis.The aggregation analysis algorithm and multi-step attack correlation algorithm were described in detail in the paper.