报警融合及关联分析技术研究

下载PDF

导出

摘要网络中各种IDS在运行过程中会产生大量独立的、原始的报警信息,这些报警信息除了具有海量的特点外,还有比较高的误报率和漏报率,导致用户难于对攻击及时做出响应.利用报警融合和关联分析技术是能解决此问题的基本手段.本文对IDS报警融合和关联技术进行了介绍,并指出了需要进一步研究的问题.

作者孙虎

机构地区盐城市地方税务局信息管理处

出处《科技资讯》 2007年第12期7-8,共2页 Science & Technology Information

关键词入侵检测数据融合报警关联攻击场景

参考文献8

1[1]T Bass.Intrusion detection systems and multisensor data fusion Communications of the ACM,2000,43(4):99～105.
2[3]Ruiu,Dragos.Cautionary Tales:Stealth Coordinated Attack HOWT0.http://www.nswc.navy.mil/ISSEC/CID/Stealth_Coordianted_Attack.html.1999
3[4]Julia Allen,Alan Christie,William Fithen et al.State of the Practice of Intrusion Detection Technology.2000.
4[5]F.Cuppens and A.Miege.Alert correlation in a cooperative intrusion detection framework.In Proceedings of the 2002 IEEE Symposium on Security and Privacy.May 2002.
5[6]P.Ning,Y.Cui,and D.S.Reeves.Constructing attack seenarios through correlation of intrusion alerts.In Proceedings of the 9th ACM Conference on Computer and Communications Security,pages 245 254,Washington,D.C.,November 2002.
6[7]A.Valdes and K.Skinner.Probabilistic alert correlation.In Proceedings of the 4th International Symposium on Recent Advances in Intrusion Detection(RAID 2001),pages 54 68,2001.
7[8]H.Debar and A.wespi.Aggregation and correlation of intrusion-detection alerts.In Recent Advances in Intrusion Detection,LNCS 2212,pages 85 103,2001.
8[9]Teng H.S.,Chert K.and Lu S.C.Adaptive real-time anomaly detection using inductively generated sequential patterns.Proc.of the IEEE Symposium on Research in Security and Privacy.Oakland,CA,May 1990,278-284

科技资讯

2007年第12期

内容加载中请稍等...