通过关联报警重建攻击场景

Rebuilding Attack Scenarios through Correlating Alerts

论文提出一系列的技术来整合两种互补型的报警关联方法:基于报警属性之间的相似性(聚类关联),和基于攻击的因果关系(因果关联)。尤其是根据入侵报警间的因果关系和它们需要满足的等同约束关系来假设和推理可能被IDSs漏报的攻击,同时使用一定的方法来整理假设的攻击重建更简单更可信的攻击场景。

This paper presents some techniques to integrate two complementary types of alert correlation methods：those based on the similarity between alert attributes（clustering correlation）,and those based on causal correlation of attacks （causal correlation）.Especially,this paper presents techniques to hypothesize and reason about attacks possibly missed by IDSs based on the equality constrain and causual relation between intrusion alerts they must satisfy.At the same time, this page uses the certain method to consolidate the hypothesized attacks in order to rebuild more simple and creditable attack scenarios.