基于威胁路径的报警关联分析方法

大量的误报大大降低了现有网络入侵检测系统的实用性,利用报警日志之间的逻辑关系是降低误报率的方法之一。提出了威胁路径的概念,在此基础上提出了基于因果关系的关联分析方法。利用网络的背景信息,发掘报警日志记录之间的逻辑关系,进一步提高报警的准确性,降低误报率。经实验验证,该方法可有效降低网络入侵检测系统误报率,并可用于辅助分析网络入侵过程。

The Correlation Analysis of Alert Logs Based on Path of Intrusion

The high rates of false negatives decrease the practicability of the recent IDS. The application of the relativities of the logs is one of the methods to decrease the rate of false negatives. In this paper, the concept of Path of Intrusion and the analysis method based on causality have been put forward. This method makes use of the information about the network to extract the relativity of the logs, distinguish the false negatives and improve the detection accuracy. As the experimental results show, this method can help decrease the rate of false negatives and analyze the process of the intrusions.