Chinese Journal of Network and Information Security ›› 2021, Vol. 7 ›› Issue (5): 132-148.doi: 10.11959/j.issn.2096-109x.2021085

• Papers • Previous Articles     Next Articles

Using rule association to generate data collection policies

Pei CHEN1,2, Fenghua LI1,2, Zifu LI1,2, Yunchuan GUO1,2, Lin CHENG3   

  1. 1 Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
    2 School of Cyber Security, University of Chinese Academy of Sciences, Beijing 100049, China
    3 China Information Technology Security Evaluation Center, Beijing 100085, China
  • Revised:2021-02-01 Online:2021-10-15 Published:2021-10-01
  • Supported by:
    The National Key R＆D Program of China(2016QY06X1203);The National Natural Science Foundation of China(U1836203);Shandong Provincial Key Research and Development Program(2019JZZY020127)

RichHTML

35

PDF下载

345

Abstract:

Collecting security-related data of devices effectively is the foundation of analyzing network threats accurately.Existing data collection methods (full data collection, sampling based data collection and adaptive data collection) do not consider the validity of the collected data and their correlation, which will consume too much collection resources, resulting in low collection yield.To address this problem, considering the factors (relationship between node attributes, network topology relationship, threat status, node resource and node similarity) that impact collection costs and benefits, a rule association method to generate collection policies was designed.In the method, two types of association rules (inter-node association rules and inter-event association rules) were adopted to generate candidate data collection items and reduced the scope of data collection.Then, a multi-objective program was designed to maximize collection benefits and minimize collection costs.Further, a genetic algorithm was designed to solve this program.Proposed method was compared with existing data collection methods.The experimental results show that the number of the collected data records of proposed method is 1 000~3 000 less than that of others per 12 hours, and the validity of the collected data of proposed method is about 4%~10% higher than others, which proves the effectiveness of the proposed method.

Key words: policy optimization generation, multi-objective optimization, collaborative data collection, multiple class-association rules mining

CLC Number: 

No Suggested Reading articles found!
Copyright of website: Editorial Office of Chinese Journal of Network and Information Security