一种基于开放聚合框架的网络流量安全监测体系设计  

Design of network traffic security monitoring system based on open aggregation framework

作　　者：王艳伟 邬江 罗赟骞 史春见 Wang Yanwei;Wu Jiang;Luo Yunqian;Shi Chunjian(China Electronics Cyberspace Great Wall Limited Company,Beijing 102209,China)

机构地区：[1]中电长城网际系统应用有限公司,北京102209

出　　处：《信息技术与网络安全》2018年第9期22-26,共5页Information Technology and Network Security

摘　　要：基于网络流量的各类安全分析检测引擎或工具越来越多,利用现有的检测引擎完成更复杂的网络流量安全监测工作变得更加有意义。提出一种基于开放聚合框架的网络流量监测体系设计,通过定义一套开放聚合式的框架和接口,来支持多种流量安全检测引擎的数据接入和告警输出,完成检测能力的聚合,实现针对基于网络流量复杂攻击场景的综合监测和多种方法验证。There are more and more various security analysis and detection engines or tools based on network traffic,so it is more meaningful to use existing detection engines to complete more complex network traffic security monitoring. This paper proposes a framework of network traffic security monitoring system design based on open aggregation framework by defining a set of open interfaces. The framework not only support multiple traffic detection engine uniform data access and the alarm output,but also completes the detection ability of aggregation. Finally,the framework implements comprehensive monitoring based on network traffic complex attack scenarios and multiple methods validation.

关 键 词：网络空间安全 网络流量安全监测 开放聚合框架 检测引擎 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]