针对目前报警信息关联技术中存在的问题,提出了基于入侵意图的报警信息关联分析技术。该技术不仅继承了基于入侵策略的报警信息关联分析方法所具有的时效性、预见性强等优点,而且提高了入侵策略模型的泛化能力,并通过建立“跳步”分析机制,提高了系统对入侵的理解能力。 Aiming at the problems existing in the current alarm information association technology, an alarm information correlation analysis technology based on intrusion intentions is proposed. The technology not only inherits the advantages of timeliness and predictability of the alarm information correlation analysis method based on intrusion policy, but also improves the generalization ability of the intrusion strategy model, and through the establishment of “jump step” analysis mechanism, improves the system Ability to understand invasion.