Computer Engineering and Applications ›› 2010, Vol. 46 ›› Issue (7): 107-109.DOI: 10.3778/j.issn.1002-8331.2010.07.032

• 网络、通信、安全 • Previous Articles     Next Articles

Improved aggregation algorithm for intrusion-detection alerts

WANG Zhuo,FAN Jiu-lun,LIU Jian-hua   

  1. Department of Information and Control,Xi’an Institute of Post and Telecommunications,Xi’an 710061,China
  • Received:2008-09-08 Revised:2008-12-26 Online:2010-03-01 Published:2010-03-01
  • Contact: WANG Zhuo

入侵检测系统报警信息聚合方法的改进

王 琢,范九伦,刘建华   

  1. 西安邮电学院 信息与控制系,西安 710061
  • 通讯作者: 王 琢

Abstract: Considering the drawbacks existed in the algorithms based on attribute differences to aggregate intrusion detection alert,an improved algorithm is proposed.The proposed algorithm has the advantages of simplicity and intuition.Experiment results on the DARPA2000 IDS test dataset indicate that the algorithm is efficient.

Key words: intrusion detection, attribute difference, alert aggregation

摘要: 针对现有基于属性差异的入侵检测系统报警信息聚合算法存在的缺陷,提出一种改进的基于属性差异的报警信息聚合算法。该方法简单、直观。在DARPA2000测试数据集上的测试说明了算法的有效性。

关键词: 入侵检测, 属性差异, 报警聚合

CLC Number: