Alarm correlation analysis-based unknown attack scene detection method

Abstract

The invention discloses an alarm correlation analysis-based unknown attack scene detection method, which comprises the following steps: (1) preprocessing multi-source massive intrusion alarms, and generating an alarm set; (2) clustering the alarm set generated in the step (1) to generate an initial attack sequence set; (3) performing correlation analysis on the initial attack sequence set generated in the step (2) to generate a multi-step attack rule set; (4) performing similarity analysis between the multi-step attack rule set generated in the step (3) and an existing attack rule, and addingattack rules in real time to generate a new attack rule base in an intrusion detection system; and (5) performing, by the intrusion detection system, intrusion detection according to the new attack rule base. The method provided by the invention can effectively solve the problems that by use of the existing intrusion detection system, the alarm information quantity is large and contents are fragmentary; and construction of a correlation scene of an IDS alarm and automatic rule adding are realized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to an unknown attack scene detection method based on correlation analysis. Background technique [0002] With the rapid development of Internet technology, security problems are also emerging one after another. The intrusion detection system is widely used in the security protection system because of its advantages of high efficiency, rapidity and good concealment. Intrusion Detection Technology (IDS) is a network security technology that actively protects itself from attacks. As a reasonable supplement to the firewall, intrusion detection technology can help the system deal with network attacks, expand the security management capabilities of system administrators (including security audit, monitoring, attack identification and response), and improve the integrity of network security infrastructure. An intrusion detection system performs real-time detection of network act...

AI Technical Summary

Problems solved by technology

[0007] The invention proposes an unknown attack scene detection method based on alarm correlation analysis, which can effectively solve the problem of large number of alarm information and fragmented content in the existing intrusion detection system, and can effectively identify the original rules by building a multi-step attack rule library Unknown variant attack behavior in the library, improving the effect of intrusion detection

Images