一种基于关联分析的攻击场景构造方法

Constructing Attack Scenarios Based on Correlation

将IDS报警归类为若干种超报警(Hyper-alert)类型,为每种超报警类型定义相应的攻击条件和攻击结果,通过对超报警的关联分析,生成超报警关联图,构造出攻击场景,从而揭示攻击者的攻击策略和攻击意图。

In order to reveal the strategy and intention of attacks, we construct attack scenarios by correlating hyper-alert on the basis of prerequisites and consequences of alert.