基于多源告警的攻击事件分析

为解决多源告警中的复杂攻击难以被发现的问题，提出一种攻击序列模式挖掘算法。利用正则表达式匹配告警，将多源告警规范化为统一格式。对冗余告警信息进行压缩，利用强关联规则训练得到的规则集聚合同一阶段的告警，有效去除冗余告警，精简告警数量。利用滑动窗口对聚合后的告警进行划分得到候选攻击事件数据集，通过改进的PrefixSpan算法挖掘得到多阶段攻击事件的攻击序列模式。实验结果表明，该算法在不依赖专家知识的前提下，能够准确并高效地分析告警相关性，还原攻击事件中的攻击步骤。相比传统PrefixSpan算法，提出的改进算法的攻击模式挖掘效率提升了48.05%。

Analysis of attack events based on multi-source alerts

In order to overcome the difficulty in discovering multi-stage attack from multi-source alerts, an algorithm was proposed to mine the attack sequence pattern. The multi-source alerts were normalized into a unified format by matching them with regular expressions. The redundant information of alerts was compressed, and the alerts of the same stage were clustered according to the association rule set trained by strong association rules, efficiently removing the redundant alerts, so that the number of alerts was reduced. Then, the clustered alerts were divided to obtain candidate attack event dataset by sliding-window, and the attack pattern mining algorithm PrefixSpan was used to find out the attack sequence patterns of multi-stage attack events. The experimental results show that the proposed algorithm can lead to an accurate and efficient analysis of alert correlation and extract the attack steps of attack events without expert knowledge. Compared with the traditional algorithm PrefixSpan, the algorithm has an increase in attack pattern mining efficiency of 48.05%.