网络入侵检测系统的警报合成算法设计

Design of Alert Merging Algorithm of Network-based Intrusion Detection System

摘要:

为了解决网络的入侵检测系统经常产生大量相似的或无用的警报数据的问题,依据法国MIRADOR项目的用于入侵检测系统的关联模型的相关研究工作,设计了一种警报合成算法.该算法采用动态的合成时间窗口和动态的最大合成数量窗口相结合,既有效地减少了无用警报的数量又保持了警报的及时性.初步实验结果表明,当NIDS产生大量相似或无用的警报时,该算法可以比较有效地降低其警报数量.

Abstract:

The problem of huge numbers of similar or false alarms is ubiquitous in most network-based intrusion detection system (NIDS).Based on the CRIM module within MIRADOR project,an algorithm is designed to merge these similar alerts to reduce the existing huge