采用攻击策略图的实时警报综合分析方法

doi:10.3969/j.issn.1001-2400.2014.05.015

J4 ›› 2014, Vol. 41 ›› Issue (5): 84-90.doi: 10.3969/j.issn.1001-2400.2014.05.015

采用攻击策略图的实时警报综合分析方法

李龙营;李金库;马建峰;姜奇

(西安电子科技大学计算机学院，陕西西安 710071)

收稿日期:2013-06-22 出版日期:2014-10-20 发布日期:2014-11-27
作者简介:李龙营(1991-)，男，西安电子科技大学硕士研究生，E-mail：leelongying@163.com．
基金资助:
国家自然科学基金委员会-广东联合基金重点基金资助项目(U1135002)；长江学者和创新团队发展计划资助项目(IRT1078)；教育部留学回国人员科研启动基金资助项目(K60013030103)；中央高校基本科研业务费专项资金资助项目

Comprehensive analysis of real-time alerts with attack strategy graphs

LI Longying;LI Jinku;MA Jianfeng;JIANG Qi

(School of Computer Science and Technology, Xidian Univ., Xi'an 710071, China)

Received:2013-06-22 Online:2014-10-20 Published:2014-11-27

摘要/Abstract

摘要：

针对警报因果关联分析方法存在攻击场景图分裂且无法及时处理大规模警报的问题，提出并实现一种采用攻击策略图的实时警报综合分析方法．首先，通过在警报关联过程中引入推断警报环节避免攻击场景图的分裂；然后，采用一种新型滑动窗口机制，为每类攻击创建一个滑动窗口，并结合时间跨度与警报数量设定窗口大小，在保证关联效果基础上具有线性时间复杂度；最后，将该方法扩展为包含实时攻击场景重构、后续警报推测及分析结果融合的综合警报分析系统．实验结果证明了该方法的实际有效性和高效性．

关键词: 入侵检测系统, 入侵分析, 关联分析, 攻击场景

Abstract:

The causal relation based alert correlation approach causes split scenario graphs and cannot process massive alerts in time. To address this issue, a comprehensive analysis approach of real-time alerts with attack strategy graphs is proposed. First, it gets rid of the splitting of the attack scenario graph by introducing hypothesizing alerts to the alert correlation process. Second, it leverages a novel sliding window mechanism, which maintains a window for each type of attacks and determines the window's size according to both the time and number of the alerts. This new mechanism only introduces linear time complexity without sacrificing effectiveness. Third, the approach is extended to a comprehensive system to reconstruct attack scenarios, predict future alerts and fuse analytical results. Evaluation results indicate that our approach is effective and efficient.

Key words: intrusion detection systems, intrusion analysis, correlation analysis, attack scenarios

中图分类号:

TP309

李龙营;李金库;马建峰;姜奇. 采用攻击策略图的实时警报综合分析方法[J]. J4, 2014, 41(5): 84-90.

LI Longying;LI Jinku;MA Jianfeng;JIANG Qi. Comprehensive analysis of real-time alerts with attack strategy graphs[J]. J4, 2014, 41(5): 84-90.

参考文献

［1］ Ning P, Cui Y, Reeves D S. Analyzing Intensive Intrusion Alerts via Correlation［C］//Proceedings of International Symposium on Recent Advances in Intrusion Detection. Stevenage: Springer Verlang, 2002: 74-94.
［2］ Ning P, Cui Y, Reeves D S. Constructing Attack Scenarios through Correlation of Intrusion Alerts［C］//Proceedings of the 9th ACM Conference on Computer and Communications Security. Washington: ACM, 2002: 245-254.
［3］ Ahmadinejad S H, Jalili S, Abadi M. A Hybrid Model for Correlating Alerts of Known and Unknown Attack Scenarios and Updating Attack Graphs［J］. Computer Networks, 2011, 55(9): 2221-2240.
［4］ Ning P, Xu D, Healey C G, et al. Building Attack Scenarios through Integration of Complementary Alert Correlation Methods［C］//11th Annual Network and Distributed System Security Symposium. Stevenage: Springer, 2004: 97-111.
［5］ Ning P, Xu D. Adapting Query Optimization Techniques for Efficient Intrusion Alert Correlation［R/OL］. ［2013-05-19］. discovery.csc.ncsu.edu/～pning/pubs/footcorldation.pdf.
［6］ Valeur F, Vigna G, Kruegel C, et al. A Comprehensive Approach to Intrusion Detection Alert Correlation［J］. IEEE Transactions on Dependable and Secure Computing, 2004, 1(3): 146-169.
［7］ Wang L, Liu A, Jajodia S. Using Attack Graphs for Correlating, Hypothesizing, and Predicting Intrusion Alerts［J］. Journal of Computer Communications, 2006, 29(15): 2917-2933.
［8］ Zali Z, Hashemi M R, Saidi H. Real-Time Attack Scenario Detection via Intrusion Detection Alert Correlation［C］//Proceedings of the 9th International ISC Conference on Information Security and Cryptology. Piscataway: IEEE, 2012: 95-102.
［9］杨洁, 刘聪锋. 模式匹配与校验和相结合的IP协议识别方法［J］. 西安电子科技大学学报, 2012, 39(3): 149-153.
Yang Jie, Liu Congfeng. IP Protocol Identification Method Using the Pattern Match and Check Sum ［J］. Journal of Xidian University, 2012, 39(3): 149-153.
［10］林晖, 马建峰. 无线 Mesh网络中基于跨层信誉机制的安全路由协议［J］. 西安电子科技大学学报, 2014, 41(1): 145-153.
Lin Hui, Ma Jianfeng. Cross Layer Reputation Mechanism based Secure Routing Protocol for WMNs ［J］. Journal of Xidian University, 2014, 41(1): 145-153.

[1]	柴艳娜,李坤伦,宋焕生. 智能汽车的入侵检测系统安全研究[J]. 西安电子科技大学学报, 2021, 48(3): 31-39.
[2]	赵婧;李兴华;薛飞洁;马建峰. 一种非合作博弈下的无线网络接入选择方法[J]. J4, 2014, 41(5): 98-104.
[3]	马苗;焦莉莉. 结构相似性灰关联在强噪声图像增强中的应用[J]. J4, 2010, 37(2): 346-352+365.
[4]	林国庆;王新梅. 利用多线程技术改造Snort系统 [J]. J4, 2007, 34(6): 887-894.
[5]	李胜广1;2;刘建伟1;2;李晖2;张其善1. 一种MANET加权自荐选簇分层IDS模型 [J]. J4, 2007, 34(2): 279-284.
[6]	姚兰;王新梅. 一种NIDS基准测试系统的设计与实现[J]. J4, 2005, 32(2): 284-289.
[7]	暂时无作者信息. 基于神经网络的入侵检测系统模型[J]. J4, 1999, 26(5): 667-671.

采用攻击策略图的实时警报综合分析方法

Comprehensive analysis of real-time alerts with attack strategy graphs

PDF (PC)

赞

可视化

被引次数

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 7

Metrics

本文评价

推荐阅读 0