OSSEC alarm data aggregation method based on category attribute division

Abstract

The invention provides an OSSEC alarm data aggregation method based on category attribute division. The method comprises: S1, collecting original OSSEC alarm data; S2, standardizing the original OSSECalarm data to obtain standardized OSSEC alarm data; S3, preprocessing the alarm data collected at the S1; S4, processing the OSSEC alarm data from the S2 and enabling OSSEC alarm data to be matched layer by layer in an ascending order; S5, calculating similarities of all attributes of all OSSEC alarm data; S6, calculating global similarities of all OSSEC alarm data and calculating weight values of all attributes of all OSSEC alarm data; and S7, according to the similarities of all attributes obtained at the S5 and weight values of all attributes obtained at the S6, calculating global similarities of all OSSEC alarm data and calculating an aggregation result. According to the invention, the conventional single-time-dependent attribute aggregation comparison is broken and a nested owner-member relationship idea is introduced; and layer-by-layer aggregation of category attributes of alarm data in an ascending order is realized based on the category attribute division algorithm and thus the attribute similarity of the adjacent alarm data is calculated flexibly. Meanwhile, the OSSEC alarm data aggregation rate and system detection rate are effectively increased and the system false alarm rate is reduced.

Description

technical field [0001] The invention relates to a data aggregation method, in particular to an OSSEC alarm data aggregation method based on category attribute division. Background technique [0002] With the rapid development of network technology, network attacks and network traffic have also increased rapidly, and the resulting security issues have also attracted our attention. Faced with the diversification of current attack behaviors, the distributed intrusion detection system has built various security devices for these formations. However, our traditional IDS’s ability to deal with attacks is not perfect. Since most of the network security devices are in an independent working state, the processing efficiency of alarm data is reduced, and it is easy to generate a large number of redundant alarms and false alarms. Phenomena such as leakage alarm. Therefore, these alarm data are aggregated, in order to obtain higher detection efficiency and more attack-related alarms, ...

AI Technical Summary

Problems solved by technology

[0004] In view of the above-mentioned shortcoming of the prior art, the object of the present invention is to provide a kind of OSSEC alarm data aggregation method based on category attribute division, to solve the problem of high false alarm rate in the prior art

Images