CAJ | 학술논문

由于缺乏评估和关联报警的背景知识,IDS(入侵检测系统)产生的海量报警无法得到更进一步的真实化确认,从而使IDS成为当今安全产品中的诟病.在事件关联范畴内的报警评估是利用被监控系统的背景知识对IDS产生的大量报警进行进一步的分析,从而把真实的危害系统的报警呈现给用户的过程.这些用于评估IDS报警的背景知识包括受害主机系统信息和网络环境信息.本文介绍了事件关联的主要结构,并着重介绍报警评估的流程和所需背景知识库;然后详细描述了基于本体的背景知识库的分类技术;最后给出基于背景知识分类技术在报警评估过程中的具体实现过程.
유우결핍평고화관련보경적배경지식,IDS(입침검측계통)산생적해량보경무법득도경진일보적진실화학인,종이사IDS성위당금안전산품중적후병.재사건관련범주내적보경평고시이용피감공계통적배경지식대IDS산생적대량보경진행진일보적분석,종이파진실적위해계통적보경정현급용호적과정.저사용우평고IDS보경적배경지식포괄수해주궤계통신식화망락배경신식.본문개소료사건관련적주요결구,병착중개소보경평고적류정화소수배경지식고;연후상세묘술료기우본체적배경지식고적분류기술;최후급출기우배경지식분류기술재보경평고과정중적구체실현과정.
Intrusion Detection System (IDS) nowadays are known for producing a huge amount of alerts that are either not related to true alerts or not represented successful attacks due to lack of information to verify and to correlate IDS events.Alert verification,in the process of event correlation,is a method that we use to determine whether an alert from IDS is a false positive and to identify the success of an attack through context information of protected environment in two aspects.That is victim host context information and network context information.This paper presents alert analysis architecture in the event correlation process and then focuses on alert verification method using ontology-based context classification approach to achieve the goal of high efficiency of verification.An implementation shows in the end for the sake of validating the feasibility of the approach.