运用基线对入侵检测警报的聚类研究

A Method of Clustering Intrusion Detection Alarms Using Baseline

在入侵检测技术发展最初的时间里,人们都关注于如何能使检测更准确以及如何降低误报率和漏报率,随着信息安全技术的进一步发展,信息安全设备产生的海量报警信息使管理员无法浏览,使从中发现最关心的安全事件变得很难,论文介绍了一种运用建立安全基线模型来实现警报聚类的方法。

Initial intrusion detection technology was interested in that how to detect attacks from network and how to reduce false positive rate. The development of information security brings larger amount of alarms which make administrator difficult to review them .This article introduces a clustering method by establishing baseline.