摘要： 利用3种轻型检测器检测对系统的攻击,对检测器发出的告警信息在时间和空间两个方向上进行信息合成。由于描述攻击包含许多不确定信息,因此将粗糙集理论应用到告警信息空间方向上的合成。实验表明该方法不仅能降低无用和重复告警信息的发送,而且可以提高检测准确率。

关键词: 协作入侵检测系统, 粗糙集, 网络安全

Abstract: In this paper three light-weighted detectors have been developed in order to protect the key host. Alerts from each detector have been aggregated and correlated in the spatio-temporal space. Due to the uncertainty in describing attacks, the rough set theory has been applied into the aggregation of alerts in the spatial space. Experiments show that this way can not only reduce the amount of futile and repetitive alerts but also increase the detection rate.

中图分类号: 

• TP393.08