一种多源安全日志融合方法的研究

Research on multi-source security log fusion method

为了有效发现网络中隐藏的攻击事件,以多源日志为研究对象,提出改进加权信任度值D-S证据理论算法来融合日志。经过数据预处理和动态自适应时间间隔阈值算法聚合生成超级告警日志,将安全设备对不同告警事件的检测率作为证据,动态修正权值并融合。实验结果与传统D-S证据理论算法的比较结果表明,改进加权信任度值D-S证据理论算法能够更准确地检测到网络中的攻击事件。

In order to effectively find hidden attacks in network, taking muhi-source log as research object, an improved weighted trust value D-S evidence theory is proposed to fuse logs. With data preprocessing and dynamic self- adaptive time interval threshold algorithm, super warning log is aggregated. Taking detection rates of different alarm events by safety equipment as evidence, the weights of alarm data are dynamically revised and fused. Comparison between experimental result and traditional D-S evidence theory algorithm indicates that the improved weighted trust value D-S evidence theory can improve the detection accuracy of network alarm event.