基于攻击症状的安全事件关联方法研究  

Research of security event correlation approach based on attack-symptom

作　　者：许宇华[1] 

机构地区：[1]中国航天科工集团第二研究院706所,北京100854

出　　处：《计算机工程与设计》2008年第10期2486-2489,2631,共5页Computer Engineering and Design

摘　　要：提出一套基于攻击症状的安全事件关联方法。根据攻击和症状间因果关系构建了安全事件关联模型,提出了依据关联模型自动计算产生安全事件关联规则的思想,并用特征代码匹配法实现事件关联。A security event correlation approach based on relationship of attack and symptom is studied. A causality model of security event correlation is discussed. And a method of automatically generating correlation rules is discussed. Then an approach how to applying code matching method to implement event correlation is introduced.

关 键 词：安全事件 关联分析 因果关系图 攻击 症状 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]