CPN攻击建模及警报相关性算法设计

Attack modeling using colored petri net and alerts correlation algorithms design

为提高当前入侵检测系统的预警质量和分析预测能力,用染色Petri网(colored petrinet,CPN)构造了攻击模型,系统性地设计了警报信息相关性分析算法。通过把'警报'和'攻击'作为2个不同实体参与模型运算,将目前主要采用的过滤观察信息为基础的关联方法提升为信息推理的演算方法。应用CPN模型转换、极小覆盖集命题等方法,对本领域中的难点问题即复合攻击、合作攻击进行了理论分析和算法设计。在此基础上开发了警报信息相关性分析(alerts correlation analysis system,ACAS)实验系统,实验结果表明算法系统对于提高入侵检测系统的警报质量和分析预测能力是可行、有效的。

In order to improve the alerts quality and prediction capability of traditional intrusion detection systems（IDS）,the advanced alerts correlation algorithms are proposed,which is based on attack scenarios modeling using colored petri net（CPN）.The current analysis approach information filtering is updated to messages logic deduction by reasoning under the model.The alert and the attack are converted to two different parameters for computation.By means of transforming CPN model and calculating the minimal covering set,the algorithms for multi-step attack and cooperative attack are designed.The experimental alerts correlation analysis system（ACAS） is programmed.That experiment results indicate that these algorithms could be applied to improve the alerts quality and prediction ability of IDS effectively.