异常检测在报警关联分析中的应用

Application of anomaly detection in alert correlation analysis

为了给报警关联提供时间控制以提高关联的合理性和效率将误报警流作为背景流量,真实报警作为整个报警流的异常。利用经典统计模型即均值方差模型检测报警流量强度的异常,进而把异常的时间段提供给报警关联,仅对异常时间段内的报警进行关联分析。实验显示,该检测模型能够为报警关联分析提供时间控制,使得关联分析能够取得更加精炼而有意义的结果。由于集中分析异常时间段内的报警,该模型可显著地帮助网络管理员节省时间和精力。

A classic statistic model namely Mean and Standard Deviation Model （MSDM） was used to control time for alert correlation analysis in order to make the alert correlation more meaningful and efficient. Taking false alerts as the background flow and true alerts as the anomaly of the alert flow, MSDM detected the anomaly of the alert flow and offered the abnormal time slice to correlation analysis. Correlation process only correlated the alerts which were in the abnormal time slice. Simulation results show that this new method can detect anomaly alert intensities and offer time control to get more meaningful correlated results. Focused on the alerts in anomaly time, this method can save much time and energy of network administrators.