安全事件综合分析系统框架及关键技术  

Framework and Key Technology for Security Event Synthetically Analysis System

作　　者：李洪江[1] 周保群[1] 赵彬[1] 

机构地区：[1]解放军信息工程大学电子技术学院,郑州450004

出　　处：《计算机工程》2008年第17期173-175,185,共4页Computer Engineering

基　　金：国家部委基金资助项目

摘　　要：为保证网络安全,布置入侵检测系统、防火墙、防病毒软件等安全产品易造成入侵检测系统的漏报和误报、防火墙的日志信息过于庞大等问题,导致整个系统的安全难以保证。该文提出一种安全事件综合分析处理系统,经过系统的事件收集与预处理、告警压制与聚合、攻击重构和关联结果分析及处理等过程,在一定程度上解决了入侵告警的误报和漏报问题,同时使得管理员更容易获得系统的整体安全状况。对系统中2种核心技术——压制聚合和攻击重构进行了描述。It is necessary to install some security equipment or system, such as/DS, firewall, integrality check system etc. to ensure network security. But, in this situation, not only would actual alerts be mixed with false alerts, but the amount of alerts would also be too much to manage. This paper presents a framework for security events, which is mainly composed of following steps： event collection, event preprocess, event condensation, event aggregation, attacks reconstruction and the result analysis. Through this process, the rate of false and naiss alert to some extent can be reduced. The aggregation algorithm and attack reconstruction technology are described simply.

关 键 词：日志和告警 系统框架 聚合 攻击重构 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]