安全事件管理系统中关联分析引擎的实现  

Security Event Management System in the achievement Correlation analysis engine

作　　者：何学东 

机构地区：[1]安氏领信科技发展有限公司,江苏南京210029

出　　处：《计算机安全》2008年第11期50-52,共3页Network & Computer Security

摘　　要：随着信息化技术的不断发展,网络攻击行为日益猖獗,大型企业为了保障企业网络的正常运转,在网络上部署了大量的安全设备。当网络攻击行为发生时,安全设备会在短时间内产生大量的安全告警事件,管理员很难在有限时间内从告警事件中获得有价值的信息。安全事件管理系统统一收集和管理这些安全事件,并将安全告警事件、网络设备和主机日志以及通过漏洞扫描获得的系统漏洞信息进行关联分析,能快速地发现网络攻击行为可能带来的危害,提高整个网络的安全性和可靠性。With the development of the information technology,the network attack is rampant day by day.To safeguard the normal work of the enterprise network,the major industry has deployed numbers of security equipment on the network.When attacks occur,the security equipment will have the massive safe warning event in a short time,the manager is very difficult to obtain the valuable information from the warning event in limited time.The Security Event Management System collects and manages these security events and analyzes the related information between the safety emergency event, the network, equipment and the host log as well as the system vulnerability information obtained by scanning the crack. So the system can quickly discover the potential threats caused by the network attack behavior and finally enhance the security and the reliability in the whole network.

关 键 词：安全事件管理(SEM) 资产 关联分析 网络安全 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论]