| 一种基于数据挖掘的多步入侵警报关联模型 |
| |
| 引用本文： | 于潇菂,努尔布力,胡亮,解男男.一种基于数据挖掘的多步入侵警报关联模型[J].吉林大学学报(理学版),2013,51(5):881-886. |
| |
| 作者姓名： | 于潇菂 努尔布力 胡亮 解男男 |
| |
| 作者单位： | 1. 吉林大学 计算机科学与技术学院, 长春 130012； 2. 新疆大学 信息科学与工程学院, 乌鲁木齐 830046 |
| |
| 基金项目： | 国家自然科学基金(批准号:61073009;61163052);国家重点基础研究发展计划973项目基金(批准号:2009CB320706);国家高技术研究发展计划863项目基金(批准号:2011AA010101);新疆大学博士启动基金(批准号:BS110126) |
| |
| 摘 要： | 基于传统网络入侵检测系统, 提出一种基于数据挖掘的多步入侵警报关联模型. 该模型能将多个入侵检测系统的警报信息进行融合, 对大量、 无序的警报信息进行分析, 发现其中的内在联系, 精简攻击事件警报, 并通过不断更新场景知识库发现融合后警报中的多步入侵行为. 与已有模型进行对比的结果表明, 该模型的关联分析方法及多步入侵知识库的建立有助于更好地结合系统的特征实现多步入侵的警报关联.
|
| 关 键 词： | 数据挖掘 异常检测 多步入侵 警报关联模型 |
| 收稿时间： | 2012-08-11 |
An Intrusion Alert Correlation Model Based on Data Mining |
| |
| YU Xiao-di;Nurbol;HU Liang;XIE Nan-nan.An Intrusion Alert Correlation Model Based on Data Mining[J].Journal of Jilin University: Sci Ed,2013,51(5):881-886. |
| |
| Authors: | YU Xiao-di;Nurbol;HU Liang;XIE Nan-nan |
| |
| Institution: | 1. College of Computer Science and Technology, Jilin University, Changchun 130012, China；2. College of Information Science and Engineering, Xin
jiang University, Urumqi 830046, China |
| |
| Abstract: | According to the researches of traditional network intrusion detection, we proposed a multi step intrusion alert collaborative model based on data mining, by which the alert information of several intrusion detection systems can be integrated so as to find the inner contacts by analysing themassive, disordered alert information, the attack alert can be simplified, and the multi step intrusion in the integrated alert information can be found through the constantly updated knowledge database. Comparison of the model with the existing model shows that the correlation analysis method of this model and the build of the multi step intrusion knowledge base really do help to the combination of the characteristics of different systems so as to realize multi step intrusion alert collaborative researches. |
| |
| Keywords: | data mining anomaly detection multi step intrusion alert correlation model |
| 本文献已被 CNKI 等数据库收录！ |
| 点击此处可从《吉林大学学报(理学版)》浏览原始摘要信息 |
| 点击此处可从《吉林大学学报(理学版)》下载免费的PDF全文 |
