欢迎您！东篱公司
退出
-
申报数据库
-
立项数据库
-
成果数据库
-
项目获奖数据库
中文摘要：
为了融合多源异构的网络安全信息,提取反映网络整体安全状况的要素信息,提出了一种基于相异度计算和指数加权DS证据理论的网络安全态势要素提取方法,该方法包括多源报警聚类和融合两个阶段。针对多源报警的不同阶段,首先研究一种基于DSimC的多源报警聚类方法,即通过计算报警之间的不同类型特征相异度来判断报警之间的相似程度;其次研究一种基于EWDS的多源报警融合方法,即通过融合不同数据源所提供的证据综合识别入侵攻击行为。实验结果表明,所提出的方法在TPR、FPR和DIR指标方面均取得了不错的效果,克服了单个安全设备误报率和漏报率高的问题,为进一步的网络安全态势评估和预测提供了有力的数据保障。
英文摘要：
For the sake of fusing multi-source heterogeneous security information and extracting security element information about the whole network,a network security situation element extraction method based on Dissimilarity Computing（DSimC）and Exponentially Weighted DS Evidence Theory（EWDS）was proposed.The method was divided into two phases including multi-source alert clustering and alert fusing.First of all,multi-source alert clustering method was put forward through computing different characteristics dissimilarity of alert to judge the dissimilarity among alerts.Then multi-source alert fusion method based on EWDS was proposed through fusing different sources to indentify intrusion attack behaviors.Experimental results indicate that the proposed method does well in True Positive rate（TPR）,False Positive rate（FPR）and Data to Information Rate（DIR）,remarkably reduces the number of alerts and enhances detection performance,and supplies data sources for network security situation evaluation and situation prediction.
同期刊论文项目
同项目期刊论文
位置：