基于权能转换模型的攻击场景推理、假设与预测

Attack scenarios reasoning,hypothesizing and predicting based on capability transition model

为了自动地从大量低级的入侵检测告警信息中构建出更高层次的攻击场景,并在一定程度上预测即将发生的攻击,提出了一种基于权能转换模型的实时告警信息相关性分析的方法。通过对推理依据的高度抽象,权能转换模型极大地降低了攻击场景构建过程的复杂度。在DARPA2000测试数据集上的测试实验结果表明,提出的方法是可行的、有效的。

To construct attack scenarios and predict intrusion intents automatically, a real-time alert correlation approach based on capability transition model was proposed. By highly abstracting the reasoning evidences, the process complexity is effectively reduced. Experiment results on the DARPA2000 IDS test dataset indicate that the method is effective and efficient.