网络安全事件关联分析及主动响应机制的研究  

ON NETWORK SECURITY EVENT CORRELATION ANALYSIS AND ACTIVE RESPONSE MECHANISM

作　　者：温辉[1] 徐开勇[1] 赵彬[1] 汪滨[1] 

机构地区：[1]信息工程大学电子技术学院,河南郑州450004

出　　处：《计算机应用与软件》2010年第4期60-63,共4页Computer Applications and Software

基　　金：国家高技术研究计划基金资助项目(2008AA01Z404);国家重点预研基金项目(9140A26010306JB5201)

摘　　要：如何从IDS等安全设备每天产生的海量安全事件中挖掘出有价值的信息,帮助管理员找到那些真正具有威胁的攻击并且及时主动的进行响应,有效地保护系统安全,这是目前网络安全管理亟待解决的问题。安全运维中心SOC(Security Operations Centre)是近几年在国内外迅速发展的一种网络安全管理技术,深入研究了SOC实现过程中涉及的安全事件关联分析、基于策略的主动响应等关键技术。How to effectively pick out valuable abnormal behaviours from numerous security events produced by all kinds of security products everyday,assisting the administrators to find those attacks with genuine menace and to response actively and timely so as to effectually safeguard the system security,it is an urgent issue to be resolved with regard to network security management. Security operations centre（SOC） is one kind of the fast-developed network security management technologies at home and abroad in recent years,in the paper the author investigates the security event correlation analysis and the policy-based active response technologies involved in SOC implementation.

关 键 词：安全运维中心 关联信息模型 策略 主动响应 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]