摘要
入侵检测系统产生的原始告警存在层次较低、相互孤立、没有关联性等不足,使得安全管理人员难以从中发现未知的、高层次的安全威胁,从而无法了解目标网络的整体安全态势。为了利用低级别告警构建攻击场景,通过分析现有的告警关联知识,针对基于数据挖掘的告警关联算法处理稀疏数据时性能较差的不足,提出了一种新的基于数据挖掘的告警关联算法。首先对现有的告警关联算法进行了分析比较;然后阐述了经典的Apriori算法和FP growth算法的机制及优缺点,并基于二维表对FP growth算法进行了改进;最后使用改进算法挖掘告警之间的关联规则,继而进行告警关联。为了验证所提方法的可行性和性能,使用Darpa数据集进行了相关的仿真测试,实验结果表明该方案可以较好地实现告警关联。
The original alerts generated by intrusion detection system have some shortcomings,such as low level,mutual isolation and irrelevance,which makes security managers be difficult to find unknown and high-level security threats and cannot understand the overall security situation of the target network.In order to make use of low-level alerts to construct attack scenarios,this paper analyzed the existing alert correlation knowledge,and proposed a new alert correlation algorithm based on data mining to solve the problem of poor performance of existing algorithms when dealing with sparse data.In this paper,firstly,the existing alert correlation algorithms were compared,then the principles and merits and demerits of classical Apriori algorithm and FP growth algorithm were elaborated,and the FP growth algorithm was improved based on two-dimensional table.Finally,the improved algorithm was used to mine the association rules between the alerts,and thus the alert correlation was proceeded.In order to verify the feasibility and performance of the proposed method,the Darpa data set is utilized to carry out relevant simulation tests.The experimental results show that the proposed scheme can achieve better alert correlation.
作者
鲁显光
杜学绘
王文娟
LU Xian-guang;DU Xue-hui;WANG Wen-juan(Information Engineering University,Zhengzhou 450001,China)
出处
《计算机科学》
CSCD
北大核心
2019年第8期64-70,共7页
Computer Science
基金
国家重点研发计划(2016YFB0501901,2018YFB0803603)资助
