入侵检测报警信息融合系统的构建与实现

Design and Implementation of Intrusion Detection Alert Fusion System

针对目前入侵检测系统(IDS)存在的误报、漏报等问题,首先分析了存在误警的原因,设计并实现了一个入侵检测报警信息融合系统的模型。该模型提出一种相似隶属函数对报警事件进行关联,最后对系统进行了实验验证。结果表明该系统能有效地减少报警数量,降低误报、漏报率,从而提高了报警的有效性。同时通过事件关联完成攻击场景的重构,为加深对攻击者攻击意图的了解带来了方便,达到预警的目的,具有较强的实用价值。

Aiming at some problems in current IDS, such as false positive, false negative, analyzes the reason of false positive. An IDS alerts information fusion model is presented, and similarity subordination functions are presented for correlation of alert event. Experiments show that the IDS alerts information fusion system is effective in reducing the number of alerts, false positive, false negative better and it can warn according to attack intention identified.