基于知识积累的告警相关方法

An Alert Correlation Method Based on Knowledge Accumulation

黑客的入侵是一个逐步积累、逐步深入的过程。在入侵过程中,黑客所积累的有关目标系统的信息越多,越有利下一步入侵的成功。现有的告警相关方法不能识别带分支的入侵过程,也不能识别属于某个入侵过程的失败的入侵步骤。该文针对这两种情况提出了一种基于知识积累的告警相关方法,这种方法不仅能识别完整入侵过程,而且能对入侵过程的相关程度及其入侵结果进行评估。

Hacker's intrusion is a process to accumulate information from the target system step by step. The more in- formation hacker collect from the target system,the more probability to succeed of the next intrusion step. The exist- ing alert correlation method can't identify the intrusion process which have several embranchment,and also can't rec- ognize the unsuccessful intrusion step belonging to certain intrusion process. Considering this two condition,this pa- per propo ses an alert correlation method based on knowledge accumulation. This kind of method not only can identify more intact intrusion process,but also can evaluate the correlation degree of the intrusion process and result of the in- trusion process.