基于WOWA-FCM的复合攻击检测模型

A Detection Model for Multi-stage Attacks Based on WOWA-FCM

为有效处理复合攻击检测中的诸多不确定性及复杂性因素,提出了基于WOWA-FCM的复合攻击检测模型。WOWA-FCM检测模型从攻击意图分析的角度,利用模糊认知图(Fuzzy Cognitive Maps,FCM)对初级入侵警报进行因果关联;并结合脆弱性知识与系统配置信息,利用WOWA(Weighted Ordered Weighted Averaging)算子融合关联数据。WOWA-FCM检测模型不仅能识别复合攻击各个阶段、构建完整的攻击视图,并且能动态地评判攻击进度和目标系统的安全状态。WOWA-FCM模型简化了传统的复合攻击检测过程,并具有较强的适应性。MstreamDDoS攻击检测实验证明了方法的有效性。

In order to handle the uncertainties and complexities of multi-stage attack detection effectively, a novel detection model for multi-stage attacks based on Weighted Ordered Weighted Averaging （WOWA） and Fuzzy Cognitive Maps （FCM） was proposed. Based on Attack Intention Analysis, the WOWA-FCM detection model implemented the Cause-Effect correlation of the primary intrusion alerts along with the vulnerability and configuration information of the target system utilizing Fuzzy Cognitive Maps, and implemented the effects fusion via WOWA aggregation operators. The WOWA-FCM approach was not only able to recognize the individual stages of a multi-stage attack, construct the whole attack scenario, but also able to evaluate the global attack process and the security states of the target system dynamically. The WOWA-FCM model simplified the conventional multi-stage attack detection process, and provided with a better adaptability. The effectiveness of this approach was verified by the Mstream DDoS detection experimental results.