关键词: 计算机应用, 报警相关性, CPN, 攻击场景, 攻击动作

Abstract: ：A method of alert correlation based on multisource data is presented. This is due to that, in order to attain a high level description of cyberattacks, the network security administrators have to manually handle the alerts from multiple sources, such as the Intrusion Detection System (IDS), firewall, antivirus software and scanner. First, an Extended Colored Petri Net (ECPN) is constructed by adding observation set, which reflects the alerts information from security tools, to the Colored Petri Net (CPN), and the formalized description and graphic modeling on ECPN are carried out. Then, an ECPNScenarioConstructor and MultistepAbstract algorithms are proposed based on ECPN. Finally, experiment is conducted with the data set of DARPA 2000 intrusion scenario correlation benchmark. Results show that this method can effectively correlate the alerts, detect the attacking strategy of the attacker early, and reduce the leakage of alerts and avoid false alerts.

Key words: computer application, alert correlation, CPN, attack scenario, attack behavior