多源入侵检测警报的决策级融合模型

Decision-level fusion model of multi-source intrusion detection alerts

为了大幅降低对训练样本的要求,摒弃苛刻的约束条件,提出了一种支持在线增量训练的警报融合模型。将初级警报向量映射为表决模式,以缩小统计空间。通过训练统计出各种表决模式在正常或攻击流量下的条件概率分布,依据统计特征的变化即时推断待检测流量的构成情况,使用阈值约束法和贝叶斯推断做出融合决策。从而拓展了适用范围,并且能较好地跟踪适应待检测流量,仅需少量训练样本便可显著提升检测性能。

In order to lessen the dependence on training samples significantly and eliminate rigorous constraint conditions, an alert fusion model that supports online incremental training was presented. Firstly, primary alerts vector was mapped to voting pattern, so as to reduce statistical space. Then, the conditional probability distributions of various voting patterns in normal or attack traffic were inferred via training. Afterwards, according to the variation of statistical characteristics, the composition of the traffic being detected was inferred instantly. Finally, fusion decision was made via threshold constraint method and Bayesian inference. Besides extended applicative scope, the model proposed can track and adapt to the traffic being detected well, and improve detection performance significantly only via small scale training.