Alarm correlation analysis method based on attack scene construction

Abstract

The invention relates to the field of data processing, and discloses an alarm association analysis method based on attack scene construction, which comprises the following steps: fusing alarm data to obtain a simplified data set; performing scene division on the simplified data set based on a dynamic time window method; on the basis of the divided scenes, performing association analysis on the simplified data set by using an alarm association method of causality association and Granger causality test to obtain an association result; and carrying out visual expression on the association result. The hidden logic relation between attack events is found through correlation analysis, and then a complete attack process is constructed to identify the intention behind the attack, so that security management personnel can conveniently prevent the attack in time.

Description

technical field [0001] The invention relates to the field of data processing, in particular to an alarm correlation analysis method based on attack scene construction. Background technique [0002] In actual network attacks, most attacks are not completed in one step. Intruders usually use multiple complex attack steps to achieve the purpose of intrusion, and IDS only generates corresponding alarm data for a single attack event, which cannot satisfy A macroscopic and complete display of the overall picture of multi-step attacks is required. For network security managers, it is difficult to identify attack intentions and take corresponding defense measures without knowing the complete attack process. Therefore, the alarm correlation analysis method performs correlation analysis on the alarm logs generated by the intrusion detection system. The purpose is to correlate the relevant attack steps behind a complete attack, and reconstruct the attack scene to identify the intentio...

AI Technical Summary

Problems solved by technology

[0003] In recent years, scholars at home and abroad have done a lot of research on alarm correlation methods, and have achieved certain research results, but the current alarm correlation methods are still relatively single, and there are still many shortcomings: Both methods can effectively correlate alarm data, but they do not achieve good correlation efficiency; on the other hand, most of them rely on prior knowledge and rule bases, making it difficult to discover new attack scenarios and build comprehensive attack scenarios.

Images