【作者】 李亚琴；

【导师】 孙传林；

【作者基本信息】 华中科技大学 ， 计算机系统结构， 2006， 硕士

【摘要】 随着Internet技术的高速发展,网络安全问题变得越来越敏感和重要,攻击者攻击手段和技术的日益复杂化、更具隐蔽性和分布性等特点,使得对入侵意图的识别变得困难。冗余的、无关紧要的告警数据的泛滥给系统管理员带来了巨大的压力和错觉,甚至是漠视告警。有效关联技术和预警技术的缺乏导致攻击的漏报或误报,最终难于准确定位攻击意图,从而不能及时给出相应的对策,给系统带来巨大的损失。SATA(Security Alerts & Threat Analysis)系统以网络安全事件集中管理、降低入侵误报率、准确识别攻击意图为目标,对多源安全工具产生的原始告警进行收集和格式化,并送到服务器进程进行关联分析。SATA系统是在对各种告警关联技术进行了深入研究的基础上设计并实现的。研究内容主要包括:关联分析系统层次结构的提出;系统各功能模块的实现;利用贝叶斯网络的概率关联算法事件严重度排序AlertRank的设计及其实验分析;基于规则库的攻击关联算法的研究及实现。系统的Agent功能模块主要是对原始告警进行采集和格式统一化。从不同的原始告警格式中抽取出我们需要的属性,并且对相同的属性使用相同的名字。告警格式的统一化为Server功能模块对告警进行存储和关联分析提供了保障。安全事件严重度分析算法AlertRank,是一种特殊的交叉关联方法,它把告警中包含的信息与真实网络环境下的漏洞信息、网络拓扑结构信息,以及系统的资产信息和安全策略进行关联,并运用贝叶斯网络的计算方法计算得到告警的威胁度值,从而得出告警的威胁度排序结果。实验表明,该算法能有效地识别高威胁度告警和无用告警。更多还原

【Abstract】 With speed development of Internet technologies, network security has become more and more sensitive and important, the complicated secret distributed attack methods and technologies have made the intrusion intention recognition more difficult. The occurrence of vast redundant inessential alerts gave system administrator enormous pressure and misconception even neglect. Lacking associate and forewarning technologies result in false negative or false positive. It’s difficult to exactly recognize intrusion intention and give corresponding counterattack, and the situation brings the system a great loss.The goals of SATA(Security Alerts & Threat Analysis) system is reducing intrusion false positive and exactly intrusion intention recognition. The system collects and formats the original alerts, and then transmits them to the server process for correlation. It was designed and realized by the the reasearch of various correlation technology. The main content includes: presenting a hiberarchy of alert correlation system, the realization of the four function module, the design and experiment analysis of probabilistic correlation algorithm AlertRank based on Bayesian network which called events severity ranking, and the realization of correlation algorithm based on rulebase.The main contribution of the Agent function module is the pretreatment of the original alerts. The module extracts the needed attributes of the alerts and gives the same attribute the same name. The consolidation of format provides guarantee for storing and correlating the alerts of server module.The AlertRank algorithm is a special cross-correlation method. It correlates the alert and the leaks, network topology, system assets, security policy in true network environment via probabilistic correlation algorithm based on Bayesian network. Performance testing proves that the algorithm can reduce alerts and false alert rates great, and exactly go to intrusion intention.更多还原