安全事件采集关键技术研究与实现  

STUDY AND IMPLEMENTATION OF KEY TECHNOLOGIES IN SECURITY EVENTS ACQUISITION

作　　者：胡卫华[1] 张利[1] 刘锡峰[1] 

机构地区：[1]中国信息安全测评中心,北京100085

出　　处：《计算机应用与软件》2012年第12期309-314,共6页Computer Applications and Software

摘　　要：针对目前安全事件采集数据格式不统一,且需要通信的安全事件数目过多等不足,提出应用于数据采集代理端的数据解码技术和安全事件分析技术。数据解码技术主要对安全事件数据进行解码,从而使不同的安全事件具有相同的格式。安全事件分析技术主要对解码后的安全事件进行过滤和关联,实现一个简单的分布式安全事件采集系统,并对所提出的两类技术进行了测试。测试结果表明,这两类技术能够较好地应用于安全事件采集代理端。Given there are the deficiency of security events data acquisition in uniform data format and too many items of the events to be transmitted, etc. , we propose in this paper the data decoding technique and security events analysis technique used at data acquisition agent. The data decoding technique is mainly used to decode the data of security events, therefore different security events will have the same data format. The security events analysis technique is mainly used to filter and associate the security events decoded. In the paper we present the implementation of a simple distributed security events acquisition system, as well as the tests on two techniques proposed. Test results show that these two techniques can be used well at security events acquisition agent.

关 键 词：安全事件 数据采集 数据解码 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]