Journal of Beijing University of Posts and Telecommunications

  • EI核心期刊

JOURNAL OF BEIJING UNIVERSITY OF POSTS AND TELECOM ›› 2008, Vol. 31 ›› Issue (6): 63-66.doi: 10.13190/jbupt.200806.63.wub

• Papers • Previous Articles     Next Articles

Analysis of Alert Correlation in Honeynet

WU Bin, ZHENG Kang-feng, YANG Yi-xian   

  1. (State Key Laboratory of Networking and Switching Technology,
    Beijing University of Posts and Telecommunications, Beijing 100876, China)
  • Received:2007-12-10 Revised:2008-07-09 Online:2008-12-31 Published:2008-12-31
  • Contact: WU Bin

Abstract:

A honeynet architecture with the analysis model of alerts is proposed. The new design of honeynet combines alerts of network intrusion detection system NIDS and HIDS to find out the correlations among them. The alerts are filtered and merged using the network information and similarity membership function. An improved Apriori algorithm is applied to discover the alert correlation knowledge which is matched to construct attack scenarios. Experiments demonstrate that with the analysis model of IDS alerts the redundant IDS alerts decrease efficiently and the correlation relationships of different attacks are constructed accurately

Key words: Honeynet, Intrusion detection, alert correlation

CLC Number: