基于本地决策的多域间合作入侵检测

Cooperative Intrusion Detection Across Multiple Administrative Domains Based on Local Strategy

在大规模多管理域网络环境中,IDS系统间合作检测更多地体现出分布式、本地化的特点。文中提出基于本地安全策略实现信息采集、交换、评估、过滤和关联分析的合作IDS模型,描述了合作IDS间共享信息可信度评估和不完整警报关联分析等方法,实现了大规模多管理域网络环境中合作IDS原型MDCI系统。该系统能够有效降低警报关联分析的误报率和漏报率,提高合作IDS系统的检测性能。

The trend towards decentralization and local strategy is addressed in cooperative intrusion detection across multiple administrative domains. This paper proposes an IDS model for data collecting, alert sharing, trustiness evaluating, alert filter and correlation based on local strategy and describes a method of trustiness evaluation of shared information among cooperative IDSs and an algorithm of alert correlation with incomplete alert information. MDCI system is provided as a prototype of cooperative intrusion detection system among multiple administrative domains and the benefits of lower false negative rate and false positive rate in the system is demonstrated.