入侵检测报警信息管理系统设计与实现

入侵检测系统的高误警率成为制约其发展的瓶颈之一。本文首先分析了目前入侵检测系统存在误警的原因,分析了进行报警信息管理的必要性,提出并设计了一个入侵检测系统报警信息管理的模型,最后对系统进行了实验验证,结果表明该系统能有效地减少报警数量。     

因果告警相关方法在入侵检测系统中的应用与实现

针对某公司入侵检测系统产品误警率高,将因果告警相关方法融入到原系统中,对告警信息进行相关分析.利用DARPA 2000入侵检测场景数据集LLDOS1.0对新系统进行实验验证,结果表明,通过新系统可有效降低误警率,并可用图形的形式显示告警信息之间的因果相关关系,形象揭示出攻击者的攻击过程与攻击策略.     

入侵检测报警信息融合系统的构建与实现

针对目前入侵检测系统（IDS）存在的误报、漏报等问题,首先分析了存在误警的原因,设计并实现了一个入侵检测报警信息融合系统的模型。该模型提出一种相似隶属函数对报警事件进行关联,最后对系统进行了实验验证。结果表明该系统能有效地减少报警数量,降低误报、漏报率,从而提高了报警的有效性。同时通过事件关联完成攻击场景的重构,为加深对攻击者攻击意图的了解带来了方便,达到预警的目的,具有较强的实用价值。     

入侵检测报警信息融合系统的构建与实现

针对目前入侵检测系统(IDS)存在的误报、漏报等问题,首先分析了存在误警的原因,设计并实现了一个入侵检测报警信息融合系统的模型。该模型提出一种相似隶属函数对报警事件进行关联,最后对系统进行了实验验证。结果表明该系统能有效地减少报警数量,降低误报、漏报率,从而提高了报警的有效性。同时通过事件关联完成攻击场景的重构,为加深对攻击者攻击意图的了解带来了方便,达到预警的目的,具有较强的实用价值。     

进化模糊分类识别在IDS中的应用

应用进化编程自动产生若干条模糊规则以检测各种攻击。在计算机网络中,难于明确划分各种进攻的界限,因此在入侵检测系统中高误警率一直是一个主要的问题,然而利用模糊逻辑,能够有效降低误警率。同时规则的自动产生,也提高了系统的灵活性,降低了对本地网络的依赖性。论文最后给出了测试结果。     

NIDS报警信息关联分析进展研究

入侵检测技术是当前网络安全领域的一个研究热点，报警关联分析是其中一个重要部分。通过报警信息的关联分析，可以显著地降低入侵检测系统的误警率，提高它的检测率和可用性，帮助网络管理员更好地掌握当前网络的安全状况。本文对当前国际上报警关联分析技术的研究现状进行了综合分析，并对现有方法进行了分类和比较。     

煤矿企业工业控制系统入侵检测算法

针对现有煤矿企业工业控制系统入侵检测算法未考虑防御因素影响、实现复杂等问题,从攻击进程和防御体系2个方面,提出了一种基于攻防树模型的煤矿企业工业控制系统入侵检测算法。首先,通过对攻击叶节点的攻击属性进行量化并构建指标体系得到攻击叶节点被攻击概率,进而得出攻击路径的入侵成功率,并结合攻击路径的入侵回报率得到攻击路径的入侵概率;然后,引入基于漏报率和误报率的入侵报警率,得到被动防御概率,通过漏洞发现率和漏洞修复率得到主动防御概率;最后,根据攻击路径的入侵概率、被动防御概率和主动防御概率,得出攻击路径最终入侵概率。实例结果表明,该算法能有效检测煤矿企业工业控制系统入侵概率,提高入侵检测的准确性。     

基于聚类算法的入侵检测技术

讨论入侵检测系统的基本技术,探讨基于智能技术的入侵检测方法,提出基于聚类算法的入侵检测系统。从实验结果来看,该入侵检测系统检测率高,误警率低,能有效满足用户的需求。     

针对入侵检测分析的Petri网建模技术研究

为有效降低检测的误警率和重复报警率,在前期研究的基础上,提出针对入侵检测分析的面向对象确定性变迁Petri网模型。将面向对象和Petri网技术有机结合起来,并进行形式化描述,就对象实例化和销毁机制进行了定义并对其确定性变迁进行了规则描述,提出可变信令和不变信令使之更适合描述入侵行为的状态。利用该技术建立扫描攻击、Mitnick攻击等几个简单攻击和复合攻击分析模型;讨论利用XML技术表示面向对象Petri网模型的方法。最后实验结果表明该模型对各种复杂攻击有良好的表示能力,相对于已有研究,更便于使用而实用化。     

基于免疫计算的IDS误警率问题研究

误警率较高是入侵检测系统（IDS）存在的一个主要问题,极大影响了检测结果的可信性。形式化分析了IDS可信问题与误报率的关系以及异常IDS误警率问题产生原因,借鉴生物免疫系统,提出了基于人工免疫思想,动态构建正常系统轮廓,抑制误警率的方法。给出了抗原、抗体的形式化描述及检测的具体过程,并进行了仿真和对比实验。理论分析和实验表明,该方法有效降低了IDS的误警率。     

一种基于信息熵的IDS告警预处理方法

针对目前入侵检测系统存在的海量重复告警、误报率偏高、告警质量低下等问题，提出一种基于信息熵的IDS告警预处理方法，用于减少误告警，聚合相似告警，生成代表单步攻击意图的超告警。首先，对IDS告警进行特征提取，用告警密度、告警周期值、源IP对应的目的IP数与攻击源威胁度这4个特征的信息熵融合结果表示一条告警所具有的特征信息量。通过与误告警的特征向量进行互雷尼信息熵的计算，从而识别出误告，并且去除误告。然后对误告去除后的告警按照IP对应关系，划分为2类：一种源IP对应一种目的IP的告警以及一种源IP对应多种目的IP的告警。分别对2类告警进行特征统计，构造5维特征信息熵向量，采用DBSCAN算法将信息量相同或者相似的告警进行聚类。最后对各个类别的告警进行动态时间窗口划分，并构建出代表单步攻击意图的超告警。实验结果表明，基于信息熵的告警预处理方法误告去除率为87.43%，告警聚合率达到98.63%，具有较好的误告去除效果以及较高的告警聚合率。     

分布式入侵检测中的数据融合模型

针对传统的入侵检测系统存在的误警率高、存在告警洪流、告警孤立等缺点，引入了数据融合方法，提出了一个分布式入侵检测中的数据融合模型。该模型对告警进行分类，采用D-S理论对多IDS告警进行融合，基于前提和后果的方法对告警进行关联，最后量化系统受威胁程度，提供了一个解决上述问题的框架和方法。     

Risk balance defense approach against intrusions for network server

The paper presents a new defense approach based on risk balance to protect network servers from intrusion activities. We construct and implement a risk balance system, which consists of three modules, including a comprehensive alert processing module, an online risk assessment module, and a risk balance response decision-making module. The alert processing module improves the information quality of intrusion detection system (IDS) raw alerts by reducing false alerts rate, forming alert threads, and computing general parameters from the alert threads. The risk assessment module provides accurate evaluation of risks accordingly to alert threads. Based on the risk assessment, the response decision-making module is able to make right response decisions and perform very well in terms of noise immunization. Having advantages over conventional intrusion response systems, the risk balancer protects network servers not by directly blocking intrusion activities but by redirecting related network traffics and changing service platform. In this way, the system configurations that favor attackers are changed, and attacks are stopped with little impact on services to users. Therefore, the proposed risk balance approach is a good solution to not only the trade-off between the effectiveness and the negative effects of responses but also the false response problems caused by both IDS false-positive alerts and duplicated alerts.     

A decision support system for constructing an alert classification model

As the rapid growth of network attacking tools, patterns of network intrusion events change gradually. Although many researches had been proposed to analyze network intrusion behaviors in accordance with low-level network data, they still suffer a large mount of false alerts and result in difficulties for network administrators to discover useful information from these alerts. To reduce the load of administrators, by collecting and analyzing unknown attack sequences systematically, administrators can do the duty of fixing the root causes. Due to the different characteristics of each intrusion, none of analysis methods can correlate IDS alerts precisely and discover all kinds of real intrusion patterns. Therefore, an alert-based decision support system is proposed in this paper to construct an alert classification model for on-line network behavior monitoring. The architecture of decision support system consists of three phases: Alert Preprocessing Phase, Model Constructing Phase and Rule Refining Phase. The Alert Processing Phase is used to transform IDS alerts into alert transactions with specific data format as alert subsequences, where an alert sequence is a kind of well-aggregated alert transaction format to discover intrusion behaviors. Besides, the Model Constructing Phase is used to construct three kinds of rule classes: normal rule classes, intrusion rule classes and suspicious rule classes, to filter false alert patterns and analyze each existing or unknown alert patterns; each rule class represents a set of classification rules. Normal rule class, a set of false alert classification rules, can be trained by using sequential pattern mining approach in an attack-free environment. Intrusion rule classes, a set of known intrusion classification rules, and suspicious rule classes, a set of novel intrusion classification rules, can be trained in a simulated attacking environment using several well-known rootkits and labeling by experts. Finally, the Rule Refining Phase is used to change the classification flags of alert sequence across different time intervals. According to the urgent situations of different levels, Network administrators can do event protecting or vulnerability repairing, even or cause tracing of attacks. Therefore, the decision support system can prevent attacks effectively, find novel attack patterns exactly and reduce the load of administrators efficiently.     

入侵响应中基于事件相关性的攻击预测算法

目前的入侵检测系统(IDS)中的响应单元只对检测出的当前安全事件做出响应,而忽略了攻击事件间隐藏的关系及攻击的最终目的。本文针对上述问题在IDS的响应单元中提出了一个利用攻击事件间的相关性对攻击的最终目的进行预测的算法。实验证明该算法提高了网络的预警能力,减少了对误报的响应,并能发现分析引擎的漏报情况。     

直觉模糊综合评判在多源告警校验中的应用研究

为了合理地解决入侵检测系统的误报率和无关报警率过高的问题,提出一种基于直觉模糊综合评判的多源告警验证方法.该方法将直觉模糊综合评判理论引入告警验证领域,并针对传统方法利用单一信息对告警判断效果不明显的问题,建立了多源多层评判因素集合.同时,给出了各评判因素隶属度和非隶属度的建立方法.最后,通过实例验证了该方法的有效性.     

报警信息关联模型的构建和实现*

协同和分布式的网络攻击对传统的网络安全防护提出了巨大的挑战,同时也对分布式入侵检测技术提出了更高的要求,而有效融合多种入侵检测系统报警信息能够提高告警的准确性。首先给出了五维度报警信息关联的定义;然后设计与实现了带有实时响应机制的层次化关联模型,该模型具有较广泛的适用性,每一层都可以作为一个单独的模块完成相应的功能;最后给出了报警信息融合模块的实现。实验证明：报警信息融合可以降低误报、漏报率,并能识别攻击意图,达到预警的目的。     

Improving the quality of alerts and predicting intruder’s next goal with Hidden Colored Petri-Net

Intrusion detection systems (IDS) often provide poor quality alerts, which are insufficient to support rapid identification of ongoing attacks or predict an intruder’s next likely goal. In this paper, we propose a novel approach to alert postprocessing and correlation, the Hidden Colored Petri-Net (HCPN). Different from most other alert correlation methods, our approach treats the alert correlation problem as an inference problem rather than a filter problem. Our approach assumes that the intruder’s actions are unknown to the IDS and can be inferred only from the alerts generated by the IDS sensors. HCPN can describe the relationship between different steps carried out by intruders, model observations (alerts) and transitions (actions) separately, and associate each token element (system state) with a probability (or confidence). The model is an extension to Colored Petri-Net (CPN). It is so called “hidden” because the transitions (actions) are not directly observable but can be inferred by looking through the observations (alerts). These features make HCPN especially suitable for discovering intruders’ actions from their partial observations (alerts) and predicting intruders’ next goal. Our experiments on DARPA evaluation datasets and the attack scenarios from the Grand Challenge Problem (GCP) show that HCPN has promise as a way to reducing false positives and negatives, predicting intruder’s next possible action, uncovering intruders’ intrusion strategies after the attack scenario has happened, and providing confidence scores.