基于P2DR模型的IDS告警实时化研究

The study on real time IDS alarm based on the P2DR model

随着互联网发展,网络安全风险日益提高。IDS入侵检测作为移动业务网中主要检测手段,目前存在日志量过大、误报率高、无法深度挖掘和告警关联等问题,因此在全国移动范围内应用效果不佳,无法起到实时检测的目的。本文基于P2DR模型,对IDS策略进行优化,对IDS告警进行过滤和聚合,并建立实时告警派单电子化流程。本文依托P2DR思想实现海量IDS告警过滤和实时派单,有效解决了IDS事件告警有效性问题,并实现了告警实时化需求。

With the development of the Internet, the network security risks are increasing day by day. IDS, as the main intrusion detection method in the mobile service network, existing the problems of the large amount of log, high misinformation rate, low excavation depth and lack of alarm correlation. Therefore the application effect is not good in the whole company, and can not play the purpose of real-time detection. Based on the P2 DR model, the IDS strategy is optimized, the IDS warning is filtered and aggregated, and the real-time alarm process is establishmented. This paper based on P2 DR idea to achieve massive IDS alarm filtering and real-time dispatching, effectively solve the problem of IDS event alarm, and realize the real-time requirements of alarm.