关键词: 攻击场景重构, 多步攻击, 攻击匹配模板, 警报关联, 入侵检测系统

Abstract: As an active security protection technology, Intrusion Detection System (IDS) can find abnormal situations and send out alarm information in time or take active protection measures, becoming an important part of the network security system. But in recent years, with the increasing scale of network attacks, IDS has become powerless in realtime analysis of complex multistep attacks. This paper designed an extensible attack matching template based on expert prior knowledge to restore and reconstruct multistep attack scene, which is used to restore attack events from the perspective of attackers and help security personnel locate security threats. The method takes realtime alarm information as input, and through mining semantic knowledge and prebuilt attack matching template, it uses matching association algorithm to aggregate and correlate alerts, restore attack scene, and display attack context. The experimental results show that, the method can achieve realtime alert processing and correlation for IDS, and the formed attack events and attack scene will also provide great help for security personnel to repair the system and prevent the next attack. At the same time, the attack matching template has scalability and the ability to deal with more future attacks.

Key words: reconstruction of attack scene, multistep attack, attack matching templates, alert correlation, intrusion detection system