| 基于多挖掘方法和CPN的告警关联系统 |
| |
| 引用本文： | 张玥,王彦,李斌,张宏莉.基于多挖掘方法和CPN的告警关联系统[J].信息安全与通信保密,2006(12):167-168. |
| |
| 作者姓名： | 张玥 王彦 李斌 张宏莉 |
| |
| 作者单位： | 哈尔滨工业大学计算机网络与信息安全技术研究中心,黑龙江,哈尔滨,150001 |
| |
| 摘 要： | 网络攻击越来越复杂,入侵检测系统产生大量告警日志,误报率高,可用性低。为此,论文提出采用聚类分析、关联挖掘算法和基于彩色Petri网的联合挖掘多步骤攻击方法进行IDS告警关联,从宏观和微观攻击轨迹角度重建攻击场景,提高了入侵检测系统的可用性。
|
| 关 键 词： | 入侵检测 彩色Petri网 告警关联 攻击场景 |
| 文章编号： | 1009-8054(2006)12-0167-02 |
| 修稿时间： | 2006年8月23日 |
Alert correlation system based on aggregation and CPN |
| |
| Zhang Yue,Wang Yan,Li Bin,Zhang Hongli.Alert correlation system based on aggregation and CPN[J].China Information Security,2006(12):167-168. |
| |
| Authors: | Zhang Yue Wang Yan Li Bin Zhang Hongli |
| |
| Abstract: | Network attack techniques become more and more complexity, IDS produce a large of alerts, and falut positive is high, availability is low. So, we introduce combinative algorithem based on aggregation analysis, correlation, and CPN method to accomplish the attacks correlation, from macroscope and microscope view we rebuild attack scenario, impore IDS's usabiliy. |
| |
| Keywords: | ntrusion Detections Colored Petri Net Alert Correlation Attack Scenario |
| 本文献已被 CNKI 万方数据 等数据库收录！ |
|
