Multi-step attack alarm associated network service interface development method

Abstract

The invention relates to a multi-step attack alarm associated network service interface development method, and belongs to the field of safety of network information. A data processing module, an alarm associating module and a network service interface developing module are provided aiming at the process design of the multi-step attack alarm associated network service interface development method; a fuzzy measured value is computed by fuzzy integral, an alarm is combined into a super alarm according to the measured value, a threshold value represented by an integral value is updated according to the combination situation of the alarms, and the support alarm is generated, weed out or deleted in a super alarm queue according to the integral value. The association of the alarms is achieved in a fuzzy integral manner, and distributed by the network service interface for being invoked. According to the method, the problems that a traditional intrusion detection system is large in system resource consumption and cannot be applicable to various terminals, in particular to mobile terminals, are overcome. Burdens of network safety staffs can be relieved, and protection to complex network attacks can be performed in a targeted manner.

Description

technical field [0001] The present invention relates to the field of network information security, in particular to a method for developing a multi-step attack alarm association network service interface, which is a method for multi-step attack alarm association with fuzzy integrals. and terminal calls for alarm correlation. Background technique [0002] As computers have brought great changes to people's way of life and work, various security issues continue to emerge, seriously threatening the security of personal, company and even national information. Traditional methods of protecting computer security are mainly passive defenses, such as firewalls, encryption, and antivirus software. The intrusion detection system (IDS) uses active methods to detect potential and ongoing threats in the network in real time, which is an effective method to ensure network security. [0003] The concept of IDS (Intrusion Detection Systems) was first proposed in the 1980s. At present,...

AI Technical Summary

Problems solved by technology

At the same time, the alarm correlation part is used to solve the problem that traditional intrusion detection technology can only identify a single attack, and it is difficult to deal with complex network attack behaviors with multiple steps. It analyzes and correlates a large number of alarm information on key nodes.

Images