论文部分内容阅读
通过对事件的源地址、宿地址和宿端口3个空间属性进行分析,枚举出事件在空间属性上的所有可能的关联特征;通过对相邻事件的时间间隔进行统计分析,提出了事件的时间关联特征可以用一个相对均方差模型描述.在此基础上给出了一种基于事件类型、空间和时间关联特征的冗余事件消除算法,它能根据冗余消除规则集实时处理入侵事件并进行冗余消除.实验结果表明,该冗余消除算法可以使冗余事件在总的事件中的比例低于1%,其冗余消除的准确性和消除程度均高于CITRA中提出的冗余消除方法.
By analyzing the three spatial attributes of the source address, sink address and sink port of an event, all the possible associated features of the event in the spatial attribute are enumerated. By statistical analysis of the time interval of the adjacent events, an event A time-dependent feature can be described by a relative mean-variance model. Based on this, a redundant event elimination algorithm based on event type, space and time correlation is proposed. It can process intrusion events in real time according to redundancy elimination rule set The experimental results show that the redundancy elimination algorithm can make the proportion of redundant events less than 1% of the total events, and the redundancy elimination accuracy and elimination degree are higher than those proposed by CITRA Elimination method.