关键词: 入侵检测系统, 误告去除, 告警聚合, 互雷尼信息熵, 聚类

Abstract: Focus on the issue for the large number of repeated alerts, high false alert rate, and low alert quality of the current intrusion detection system, an IDS alerts preprocessing method based on information entropy is proposed to reduce false alerts, aggregate similar alerts, and generate super alerts that represent the intent of a single step attack. First, the feature extraction of the IDS alerts are performed. The information entropy fusion result of the four characteristics of the alert density, the alert period value, the source IP address corresponding destination IP address numbers, and the attack source threat degree indicates the amount of feature information that an alert has. By calculating the Rainey information entropy with the feature vector of the false alert, the false alert is recognized and removed. Then, the alerts that the false alerts have been removed are classified into two types according to the IP correspondence: one type of source IP address corresponding to one destination IP address and one source IP address corresponding to multiple destination IP addresses. The two types of alert features are counted separately, and the 5-dimensional feature information entropy vectors are constructed. The DBSCAN algorithm is used to cluster the alerts with the same or similar information. Finally, the dynamic time windows are divided for each category of alerts, and the super alerts that represent the intention of single-step attacks are constructed. The experimental results show that the alerts preprocessing method based on information entropy has a false alert reduction rate of 87.43% and an alert aggregation rate of 98.63%, which has a good false alert reduction effect and a high alert aggregation rate.

Key words: intrusion detection system, false alerts reduction, alerts aggregation, Rainey information entropy, clustering