A method for network intrusion detection and alarm

Abstract

Based on the network intrusion detection and alarm method, the IDS alarm information attributes include time stamp, source IP, destination IP, port number, attack type and detector ID, and determine the following basic elements; 1) node and service; 2) node value and service value ;3) node security degree; 4) alarm reliability; 5) alarm risk; The evaluation of the alarm information also needs to evaluate the environmental matching degree of the alarm information, so its algorithm is still multi-layered; 6-1), calculate the environmental matching degree according to the matching degree of known environmental factors; 6-2), use and The method of calculating the matching degree of the environment is the same method to calculate the credibility and danger level and the final alarm threat level; the state of the attack type credibility is divided into three types: high, medium and low, and the values ​​are 1, 0.6, and 0.2 respectively. , the state of the correlation attack is respectively set to three states of strong correlation, weak correlation and no correlation.

Description

1. Technical field [0001] The invention relates to a new method for network intrusion detection and alarm. 2. Background technology [0002] Since James Anderson first proposed the concept of intrusion detection in the 1980s, intrusion detection system as a component of network security has achieved great development. Many R&D institutions and security vendors are conducting research and development in this area, and have launched many corresponding products. Although more and more powerful, they all currently suffer from an important problem: excessive false positives. On the one hand, this adds a heavy workload to the administrator, so that it may ignore the key attack events that really need to be handled in the system; Execute well. 3. Contents of the invention [0003] The object of the present invention is, from the characteristic of IDS (intrusion detection) self, has proposed a Threat-based Dynamic Alerts Analysis TDAA (Threat-based Dynamic Alerts Analysis) mode...

AI Technical Summary

Problems solved by technology

Although more and more powerful, they all currently have an important problem: too high false positives

On the one hand, this adds a heavy workload to the administrator, so that it may ignore the key attack events that really need to be handled in the system; on the other hand, the high false alarm rate makes automatic intrusion response, such as linkage with the firewall, impossible carry on well