安全关联分析相关技术的研究  

Research on the techniques of security events correlation

作　　者：高雷[1] 肖政[1] 韦卫[1] 孙育宁[1] 

机构地区：[1]中国科学院计算技术研究所

出　　处：《计算机应用》2005年第7期1526-1528,1539,共4页journal of Computer Applications

基　　金：国家863计划项目(2002AA142030);国家863计划项目(2003AA148020)

摘　　要：着重研究网络安全集中管理系统中的关联分析技术,对其通用体系结构及其关键分析技术(产生式关联、即时关联等)、研究趋势(模式抽取、部署架构等)进行了探讨,并提出了基于层级式规则的关联分析解决方案。The events correlation techniques in security integration management systems were introduced. A normal architecture of the correlation engine was introduced, and some discussions on the critical technologies and the main achievements in the field were put forward. The directions of the technology development were analyzed and evaluated, such as pattern obtainment, engine distribution and performance promotion. At last, a solution based on hierarchical rules to correlate events was presented.

关 键 词：安全关联分析架构 产生式关联 即时关联 引擎部署 模式抽取 层级式规则 

分 类 号：TP393.07[自动化与计算机技术—计算机应用技术]