HS-StreamCube:网络安全事件流实时多维分析系统  

HS-streamCube:Real-time multi-dimensional analysis system on network security event stream

作　　者：甘亮[1,2] 李润恒[1] 贾焰[1] 刘健[3] 

机构地区：[1]国防科学技术大学计算机学院 [2]第二炮兵指挥学院 [3]96167部队

出　　处：《计算机工程与科学》2013年第3期72-79,共8页Computer Engineering & Science

基　　金：国家863计划资助项目(2006AA01Z451;2007AA01Z474;2007AA010502)

摘　　要：大规模网络安全监控应用中,决策者应用数据流联机在线分析(Stream OLAP)技术对网络安全事件流建立流数据方(Stream Cube)进行实时分析,以了解当前网络安全状况并动态评估当前网络安全态势。由于内存容量有限,Stream Cube只关注当前时间窗口内的数据,而对于时间窗口外的过期数据则采用近似存储或简单地丢弃,所以不支持超出时间窗口范围的大时间窗口查询。针对以上缺陷,提出一种多维多层安全事件流实时分析框架HS-Stream Cube,采用内存和外存两层混合存储模式实现任意时间窗口的精确查询;然后根据数据流特点重点研究两层混合存储模式下HS-StreamCube的模型、构建、存储管理和查询等;最后通过实验验证该系统的可用性和高效性。In the applications of large-scale network security monitoring, data stream of security e vents is analysised real timely to acquire the characteristic of current security in the network and to as sess dynamically the current security situation with Stream OLAP by building Stream Cube. Because of the limited memory capacity, Stream Cube only concerned about the current data within the time win dow,but expired data is stored approximately or simply discarded, so it do not support the query with time beyond the scope of current time window. We propose a real-time StreamCube-based multi dimen- sional and multi-level analysis framework on security event stream, Hybrid Storage-StrearnCube ,which is implemented by a two-tier （memory and disk） storage model. On the basis of characteristics of data stream,we focus on the modeling, building, storing and querying of HS-StreamCube within the two-tier storage model. Efficient experiments verify the availability and efficiency of the system.

关 键 词：流数据方 网络安全事件 混合存储 联机在线分析 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]