基于数据挖掘和本体的入侵警报关联模型

Intrusion alert correlation model based on data mining and ontology

为了突破入侵检测领域的原有瓶颈,提出了一种新的基于数据挖掘和本体的入侵警报关联模型。该模型通过对底层警报的聚类和分类,发现并且筛选攻击,然后根据已建立的基于本体的攻击知识模型,对这些攻击进行关联,以达到识别、跟踪和预测多步攻击的目的。通过对KDD Cup1999和DARPA 2000数据集的模拟实验,验证了模型的有效性。

With the gradual development of network application fields, the attack patterns have reached their delicacy and multi-steps from the coarse and simplistic pattern in their early days. In order to redeem the flaws of intrusion detection technology, an intrusion alert correlation model based on data mining and ontology （IACMDO） is proposed. IACMDO deals with underlayer alert through cluster and classification, and builds attack knowledge model by ontology, realizing the detection, tracing and predicting against multi-steps attack. The performance of traditional IDS is upgraded through simulations of KDD Cup 1999 and DAPRA 2000 datasets, which verifies the efficiency of the proposed alert correlation model.