入侵检测中基于序列模式的告警联系分析.pdfVIP

第38 卷 第3 期 电 子 科 技 大 学 学 报 Vol.38 No.3 2009年5月 Journal of University of Electronic Science and Technology of China May 2009 入侵检测中基于序列模式的告警关联分析 武 斌，杨义先，郑康锋 (北京邮电大学网络与交换技术国家重点实验室 北京 海淀区 100876) 【摘要】提出一种基于序列模式的告警关联分析模型，实现对攻击告警的分析。该模型预处理部分利用网络拓扑信息和 告警属性相似度隶属函数对原始告警进行过滤和融合；在WINEPI算法的基础上，考虑告警数据库增长的情况，提出一种告警 的增量式序列模式挖掘算法，用于关联规则发现；在线关联模块匹配规则库形成攻击场景图，并预测未知攻击事件。使用2000 DARPA攻击数据集测试表明，该模型能够明显改善入侵检测系统的性能，验证了模型和算法的有效性。 关 键 词 告警关联; 数据挖掘; 增量式更新; 入侵检测; 序列模式 中图分类号 TP393.08 文献标识码 A doi:10.3969/j.issn.1001-0548.2009.03.023 Analysis of Alert Correlation Based on Sequential Pattern in Intrusion Detection WU Bin, YANG Yi-xian, and ZHENG Kang-feng (State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications Haidian Beijing 100876) Abstract An alert correlation model based on sequential pattern is presented for the analysis of attacker alarm. Alerts are filtered and merged by means of the network information and similarity membership function first. In the alert correlation module, an incremental sequential algorithm based on WINEPI is employed aiming at the correlation rule mining when the rule database increases. The online correlation module matches rules and constructs attack scenarios. The experiment results with the 2000 defense advanced research projects agency (DARPA) intrusion detection scenario specific datasets indicate that the proposed alert correlation model can improve the performance of intrusion detection system (IDS) efficiently. Key words alert correlation; data mining; incremental updating; intrusion detection; sequential pattern