计算机应用 ›› 2011, Vol. 31 ›› Issue (05): 1271-1275.DOI: 10.3724/SP.J.1087.2011.01271

• 信息安全 • 上一篇    下一篇

TCP有限状态机和协议解析在伪警报去除中的应用

帅春燕1,2,江建慧1,欧阳鑫3   

  1. 1.同济大学 电子与信息工程学院,上海201804
    2.昆明理工大学 电力工程学院,昆明650093
    3.昆明理工大学 信息与自动化学院,昆明650093
  • 收稿日期:2010-10-21 修回日期:2010-12-14 发布日期:2011-05-01 出版日期:2011-05-01
  • 通讯作者: 帅春燕
  • 作者简介:帅春燕(1976-),女,四川成都人,讲师,博士研究生,CCF会员,主要研究方向:入侵检测、攻击关联、警报融合;江建慧(1964-),男,浙江淳安人,教授,博士生导师,主要研究方向:电路可靠性评估、容错计算、软件可靠性;欧阳鑫(1971-),男,广西柳州人,讲师,博士研究生,主要研究方向:知识表示、语义网、数据挖掘。
  • 基金资助:

    国家863计划项目(2007AA01Z142);上海市科学技术委员会信息技术领域重点科技攻关计划项目(04DZ15032;06DZ15003)。

TCP finite state machine and protocol parse applied in removal of false alerts

SHUAI Chun-yan1,2, JIANG Jian-hui1, OU-YANG Xin3   

  1. 1. School of Electronics and Information, Tongji University, Shanghai 201804, China
    2. Faculty of Electric Power Engineering, Kunming University of Science and Technology, Kunming Yunnan 650093, China
    3. Faculty of Information Engineering and Automation, Kunming University of Science and Technology, Kunming Yunnan 650093, China
  • Received:2010-10-21 Revised:2010-12-14 Online:2011-05-01 Published:2011-05-01
  • Contact: shuai chunyan

摘要： 面对入侵检测系统(IDS)产生的海量警报,提出了一种基于协议解析和传输控制协议(TCP)有限状态机的伪警报去除方法。对于无连接的请求/应答协议,同时分析请求数据包的攻击特征和应答数据包的返回状态码来去除伪警报;对于TCP,在协议分析的基础上建立TCP数据包的有限状态机的模型,通过判断系列数据包是否为同一TCP连接、是否包含攻击序列来去除伪警报。在DARPA2000的数据集上的实验结果表明,此方法的误警率平均降低了59.47%,对TCP和请求/应答协议的警报的识别率达到76.67%。该方法简单又有效,依赖IDS的攻击特征库,可以插件的形式在线实现。

关键词: 入侵检测, 请求/应答协议, 传输控制协议, 有限状态机, 协议解析, 伪警报

Abstract: Concerning the enormous alerts produced by Intrusion Detection System (IDS), a method based on protocol parse and Transfer Control Protocol (TCP) Finite State Machine (FSM) model was proposed to remove the false alerts. To the alerts produced by connectionless request/response protocol, the method made judgement through the analysis of the attack features of the request packets and return status code of response packets; to the alerts produced by the TCP, the paper parsed the packets and built up TCP FSM model to make judgement whether the series packets came from the same TCP connection, whether the TCP connection included attack sequences to remove the false alerts. Lastly the experiments made on DARPA 2000 datasets show that the proposed method can reduce the false alert more than 59.47% on average, and the alerts recognition rate of the TCP and the request/response protocol reaches 76.67%. This method is simple and efficient which depends on the attack features database of IDS, and can be implemented on line by plug-in.

Key words: intrusion detection, request/response protocol, Transfer Control Protocol (TCP), Finite State Machine (FSM), protocol parse, false alert

版权所有 © 2021 四川计算机应用杂志社有限公司
蜀ICP备 05010208 号-3　新出网证(川)字026号
技术支持：北京玛格泰克科技发展有限公司
访问总数：
今日访问：