| 摘要: |
| 复合攻击是网络入侵的主要形式之一.如何检测复合攻击是当前入侵检测研究的一个重要方向.这项研究对入侵检测的作用主要表现在以下几个方面:(1)减少误报和漏报;(2)实现对未知攻击的检测;(3)攻击预测.尤其是第3点,可能使被动的检测发展为主动的有针对性的防御.经过对复合攻击模式的大量研究,提出了一种基于入侵意图的复合攻击检测和预测算法.该算法采用扩展的有向图来表示攻击类别及其逻辑关系,按照后向匹配和缺项匹配的方式对报警进行关联,根据已关联攻击链的累计权值和攻击逻辑图中各分支的权值计算其可能性.该算法可以实现复合攻击的检测,在一定程度上预测即将发生的攻击,并且对未知攻击有一定的检测能力,还可以大幅度地减少误报和一定的漏报.最后介绍了相应的实验过程和结果分析,证明了算法的有效性. |
| 关键词: 复合攻击 入侵意图 攻击预测 攻击逻辑关系图 |
| DOI： |
| 分类号: |
| 基金项目:Supported bythe National Natural Science Foundation of China under Grant Nos.60403006,90104030(国家自然科学基金);the National Grand Fundamental Research 973 Program ofChina under Grant No.G1999035801(国家重点基础研究发展规划(973)) |
|
| A Detection and Forecast Algorithm for Multi-Step Attack Based on Intrusion Intention |
|
BAO Xu-Hua,DAI Ying-Xia,FENG Ping-Hui,ZHU Peng-Fei,WEI Jun
|
| Abstract: |
| The multi-step attack is one of the primary forms of the current intrusions. How to detect these attacks is an important aspect of IDS research. The correlation research to intrusion detection performs mainly on the following aspects: (1) reducing the false positives and false negatives; (2) detecting unknown attacks; (3) attack forecasting. Especially the development of the third point perhaps improves the passive detection to the active protection. Through the study on patterns of the multi-step attack, a detection and forecast algorithm is designed for multi-step attack based on intrusion intention. In this algorithm, an extended directed graph is used to show attack types and their relations, while the correlation is performed according to the method of backwards matching and absent matching. Based on the weighted summation of correlation attack’s chain and the branch’s weights on the logic graph of attack, the probability of the next attack can be computed. The effect of this algorithm includes the detection of multi-step attack, attack forecasting, detecting unknown attacks, and reducing the false alarms. This paper also presents the process of experimental and analysis result for validity of the algorithm. |
| Key words: multi-step attack intrusion intention forecast attack logic graph of attack |
