摘要
提出了一种基于入侵事件统计规律的安全预警方法,包括聚类分析、周期分析、趋势预测。依据某一攻击发生的历史分布特点,通过聚类分析,取得入侵频数序列;周期分析确定入侵事件发生的周期性;预测未来时间入侵发生趋势。讨论了时间粒度对预测效果的影响,以及算法对周期性攻击预测的适应性。实验结果表明:该方法对周期性攻击的预警误报率为19%和漏报率为27%。
Statistics based early warning method is proposed. It covers clustering, cycle analyzis and prediction. Clustering results in intrusion frequency according historical intrusion events. Cycle analysis testifies whether there is a cycle. Prediction gives future frequency of attacks. Relationship between clustering time and false positive rate and false negative rate is discussed and experimented. It shows periodical intrusion events gains better result than the non-periodical.
出处
《计算机科学》
CSCD
北大核心
2004年第11期77-79,129,共4页
Computer Science
基金
863资助项目"战略预警与监管体系结构研究"(2002AA142040)
