基于入侵行为模式的告警关联

Alerts Correlation Based On Intrusion Action Pattern

本文提出了一种基于入侵行为模式的告警关联方式。入侵行为模式是定义在时间基础上的一组谓词公式,其实质是通过时间限制联系在一起的入侵事件的集合。该方法在对大量告警进行关联的同时,对虚警的处理尤为有效。

This paper proposes to use intrusion action pattern to correlate alerts. Intrusion action pattern are sets of predicates related on times. In other words, it＂ s a set of events, linked together by time constraints. Our method has been proved to be effective for reducing negative alerts.