一种新的基于分布式入侵检测的警报聚类方法

针对大量的异构入侵检测传感器产生的警报泛滥问题，提出了一种在线警报聚类融合模型．该模型根据自我学习和调节，建立元警报作为警报聚类融合的基础，对新产生的警报进行分类、聚类，最终将警报特征与元警报融合，扩充元警报的特征信息．实验结果表明该方法能够有效地减少警报数量，提供具有指导意义的入侵响应，并且聚类结果可被用来进行进一步的网络态势评估．

A Novel Method of Alarm Clustering Based Distributed Intrusion Detection

In respect to the issue of alarms flooding,which is resulted from multiple detection sensors in terms of intrusions,this article proposes a novel on-line model on alarms clustering and fusion.Based upon self-learning,adjustment,and establishment of meta-alarms by clustering and fusing,this new model will classify,cluster and eventually fuse the new alarm with an existing meta-alarm.Through experiment,the result shows that this emerging model has some significant improvements.For instance,it can dramatically decrease the quantity of alarms and provide the instructive signals on intrusion respondence.Moreover,the result of clustering can be utilized in the further evaluation on threat analysis.