关键词: 网络安全, 入侵检测, 告警关联, 安全运营中心（SOC）

Abstract: Cyber attack behavior analysis techniques can be roughly classified as network-oriented analysis and attacker-oriented analysis.Compared with traditional network-oriented attack behavior analysis，attacker-oriented attack behavior analysis takes account of the relationship among attackers，so that it can present more accurate and more reliable performance.Based on the attack behavior analysis techniques that the authors have presented before，the design and implementation of an attacker-oriented intrusion alert analysis prototype system CABAS is presented.The system is evaluated under Darpa2000 intrusion detection evaluation datasets，the experimental results show that this approach has potential in analyzing complex cooperative attacks and improving the effectiveness and efficiency of security management.

Key words: network security, intrusion detection, alert correlation, Security Operation Center（SOC）