入侵检测系统中报警验证模块的设计与实现.pdfVIP

第34卷 第2期 计 算 机 工 程 2008年1月 VoL34 No。2 Computer Engineering January 2008 · 开发研究与设计技术· 文章编号；100o__3428(2008)02—0267—03 文献标识码：A 中图分类号：TP393·08 入侵检测系统中报警验证模块的设计与实现 左 晶 ，段海新2 p于雪莉 (1 清华大学电子工程系，北京 100084；2．清华大学信息网络工程研究中心，北京 100084) 摘 要：传统入侵检测系统虽然可以根据特征匹配的方法检测出攻击企图，却无法验证攻击企图是否成功，生成的报警不仪数量巨大而且 误警率很高。该文提出一种结合漏洞扫描工具对入侵检测系统生成的报警进行验证的方法，根据被攻击主机是否包含能使攻击成功的漏洞 来判定攻击能否成功，对攻击的目标主机不存在对应漏洞的报警降低优先级，从而提高报警质量。说明了报警验证模型各部分的设计和实 现方法，系统运行结果显示该方法能有效地压缩报警量，降低误警率，帮助管理员从大量数据中找到最应该关注的真实报警。 关健诃：报警验证；入侵检测系统；网络安全 Design and Implementation of Alert Verification Module Ill T ● ● 1 · ·- ，1 · ln lntrUSl0n JJetection bystem ZUO Jing ，DUAN Hai．xin ，YU Xue．1i (1．Department of Electronic Engineering，Tsinghua University，Beijing 1 00084； 2．Research Center of Information Network Engineering，Tsinghua University，Beijing l 00084) |Abstract]Traditional intrusion detection system detects intrusion attempts using signature—based method，but it can hardly determine if the attempt is successfu1．As a result，alerts generated by IDS are not only huge in number but also poor in data quality，j．e．containing false positive alerts．This paper presents a method to verify alerts using vulnerability—scanning tools．The idea of alert verification is to check if the destination host has the necessary vulnerability that can make the intrusion successfu1．According to the result of alert verification process，attacks that possibly failed are degraded in priority．The experimental result shows that the alert verification model in distributed IDS can compress the duplicated alerts，reduce false positives efficiently，which helps network a