Attack detection method based on spatiotemporal event correlation in intranet environment [内网环境下基于时空事件关联的攻击检测方法]

作者：Sun W.; Zhang P.; He Y.; Xing L.

来源：Journal on Communications, 2020, 41(1): 33-41.

DOI：10.11959/j.issn.1000-436x.2020001

• Intranet attack detection
• Intrusion detection system
• Process query
• Spatiotemporal event

In view of the fact that a single event as an attack detection feature leads to a higher false positive rate, an intranet attack detection method using Bayesian network model for cross-space event correlation and Kalman filter linear model for cross-temporal event correlation was proposed. Based on the method, a process query system was implemented, which can scan and correlate distributed network events according to the user's high-level process description. Experimental analysis show that the proposed method can significantly reduce the false positive rate of intranet attack detection without increasing the computational overhead.

• 单位
  中国科学院大学; 北京交通大学