网络安全事件的关联分析方法的比较研究

Correlation Analysis Summarization of Network Security Event

随着当前攻击手段和技术的日益复杂化,一次入侵事件往往需要多个步骤才能完成,这些步骤都是彼此相关的。但是传统的入侵检测集中于检测底层的入侵或异常,所检测到的结果也仅仅是一次完整入侵的一部分,所以不能将不同的报警结合起来以发现入侵的逻辑步骤或者入侵背后的攻击策略。关联分析技术将不同分析器上产生的报警进行融合与关联分析,极大地减少了报警的数量,降低了入侵检测的误报率,并且适当的减少了入侵检测的漏报率。文中在对网络安全事件关联分析方法的系统结构进行分析后,着重介绍了当前比较流行的几种网络安全事件关联分析方法,最后对各种方法进行了比较研究。

With the development of attack means and complex technologies, an intrusion detection system event commonly needs many steps to be successful. Tranditional intrusion detections focus on intrusion or abnormality at bottom layer, so they can not combine various types of alerts to find logical steps of attack policies behind the intrusions. Correlation technologies combine the alerts from different analyzers and correlate them, which greatly reduce the numbers of alerts, decrease the false positive and false negative properly. This article firstly analysizes the system structure of correlation means of network secure events, then stressly introduces several popular ways of network secure events correlation analysises.