基于IDMEF和分类的报警聚合

Alert aggregation based on IDMEF and category

如何聚合来自不同IDS的报警以减少重复报警是分布式IDS研究的重要问题。设计了一种入侵检测消息交换格式(IDMEF)报警消息格式规范,通过对IDMEF数据模型中的Alert类扩展而成,可统一描述不同IDS上报的报警信息。为有效聚合IDMEF报警,对基于分类和相似度的原始报警聚合算法进行了改进,并在Snort平台上实现了报警聚合模块原型和IDMEF报警生成模块原型。在DARPA99数据集上的实验结果证明了该方案的有效性。

How to aggregate and reduce duplicated alerts from different Intrusion Detection System （IDS） is one of the most important problems in distributed IDS research area. The article proposed a type of Intrusion Detection Message Exchange Format （IDMEF） alert specification extending the alert class structure of IDMEF data model to universally define the format of the alerts originating from different IDS. In order to efficiently aggregate this new type of IDMEF alerts, the article proposed an improvement to the original algorithm that was based on category and similarity. The prototype of alert aggregation module and IDMEF alert generation module has been implemented on the Snort platform. Experiments on DARPA99 data sets demonstrate the effectiveness of our method.