信息安全报警多级融合模型

Multilevel Fusion Model of INFOSEC Alert

报警融合是精简冗余报警,识别复杂攻击场景的有效方法,当前的报警融合方法大都局限于融合的特定方面。多级融合模型通过报警的标准化、验证、聚合与关联等环节,可以层层精简报警,从低层报警中抽象出高层攻击场景。实验结果证明该模型是可行的,且具有较高性能。

Alert fusion is an effective method to reduce redundant alerts and recognize complicated attack scenario.Currently,most proposed fusion methods are concentrate on special aspects.The multilevel fusion model can implement alert normalization,verification,aggregation and correlation,the low-level alerts are reduced layer upon layer,and then the high-level attack scenario is abstracted from alerts.The experimental results show that the model is effective and efficient.