入侵检测系统中的策略性警报节流
Strategic Alert Throttling for Intrusion Detection Systems
摘要：
网络入侵检测系统本身正在成为攻击者的目标。警报泛滥攻击可用于通过将恶意活动隐藏在攻击者发送的大量虚假警报中来隐藏恶意活动。虽然这些类型的攻击是很难完全停止，我们的目标是目前的技术，提高警报吞吐量和能力，这样的程度上，成功地安装攻击所需的资源变得令人望而却步。提出的关键思想是将令牌桶过滤器与实时相关算法相结合。当检测到攻击时，该算法抑制了IDS的警报输出。关联算法中使用的攻击图用于确保对形成策略至关重要的警报不会被节流丢弃。
英文摘要：
Network intrusion detection systems are themselves becoming targets of attackers. Alert flood attacks may be used to conceal malicious activity by hiding it among a deluge of false alerts sent by the attacker. Although these types of attacks are very hard to stop completely, our aim is to present techniques that improve alert throughput and capacity to such an extent that the resources required to successfully mount the attack become prohibitive. The key idea presented is to combine a token bucket filter with a realtime correlation algorithm. The proposed algorithm throttles alert output from the IDS when an attack is detected. The attack graph used in the correlation algorithm is used to make sure that alerts crucial to forming strategies are not discarded by throttling.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
