【作者】 杨强； 谷利泽；

【Author】 YANG Qiang GU Li-ze (Information Security Center,State Key Laboratory of Networking and Switching Technology,Beijing University of Posts and Telecommunications,Beijing 100876)

【机构】 北京邮电大学网络与交换技术国家重点实验室信息安全中心；

【摘要】 对手动处置入侵检测告警的弊端,提出了一种基于模糊综合评判理论的告警处置模型.该模型能够综合重要的网络安全因素,根据专家的评判结果,计算出告警事件的危险级别,然后根据危险级别来决定是否启用防火墙截断连接.通过实验表明,该方法不仅能够减轻安全管理员人为处置告警的负担,还能及时地将攻击行为拒之门外,较好地实现安全防护的功能。更多还原

【Abstract】 In order to resolve the problem of manual alert disposal in Intrusion Detection System,a model of alert disposal based on the theory of Fuzzy Integrated Evaluation is proposed.It’s a desirable fact that the model could smartly calculate the danger level of alert events according to safe elements of the network environment and experts’ evaluation,then ftrewall would be activated if the level is high.By the experiment,it demonstrates that the scheme could not only lighten the security manager’s burden of manual alert disposal,but also prohibit the attack behaviors duly and guarantee the network security preferably.更多还原