摘要： 一个攻击者要完成一次成功的入侵通常要通过几个步骤来完成,而这些步骤之间往往不是互相独立的,前面的步骤通常是为后面步骤所作的铺垫。但传统的入侵检测集中于检测低层的入侵或异常,所检测到的结果仅仅是一次完整入侵的一部分,不能将不同的报警信息结合起来以发现入侵的逻辑步骤或者入侵背后的攻击策略。如果将不同分析器上产生的报警信息进行融合与关联分析,则会更有效地检测入侵。文章介绍了几种报警关联方法,其中重点介绍了基于报警信息先决条件和结果的报警信息关联方法,并对这几种方法进行了比较和评价。

关键词: 入侵检测, 攻击, 报警关联, 超报警类

Abstract: Generally, an intruder must perform several steps of actions to achieve a successful intrusion. The steps of actions are often not independent. A previous step is usually the preparation of the succeeding step. But traditional intrusion detection systems always focus on low-level attacks or anomalies, and what they capture is only a part of a whole intrusion. They cannot associate different alert information to find the logical steps or the attack strategies behind these intrusions. If the alerts produced by different analyzers can be fused and correlated, intrusions will be detected more efficiently. In the paper several alert correlation approaches are introduced. Among them an alert correlation method based on prerequisites and consequences is focused on. Comparisons and evaluations of these approaches are also made.

中图分类号: 

• TP393.09