【摘要】 针对网络安全系统中普遍存在大量冗余报警的问题,本文提出一种新型报警处理模型。该模型通过相似性评估方法和分层机制对报警信息进行聚类,有效地减少了报警信息量;同时通过关联分析技术挖掘报警信息之间的潜在关联并生成新的规则,增强了识别未知攻击的能力,提高了聚类效率。更多还原

【Abstract】 Aiming at the problem that there are generally a great deal of redundant alerts in network security systems,this paper proposes a new transaction model which clusters the alerts by means of similarity evaluation and a hierarchical mechanism to reduce the amount of alerts efficiently.In addition,this model mines the potential correlation of alerts and produces new rules via association analysis, which will be helpful in recognizing new attack patterns and improving the efficiency of clustering.更多还原