CAJ | 학술논문

为了解决安全管理中无效的重复安全事件以及事件之间独立分析的问题，需要对安全管理平台中的关联算法重新进行设计。结合当前安全管理平台并通过分析几种关联算法的优劣性，从中选择了概率相似度算法和先决条件算法作为研究对象，提出了一种基于两者的混合关联算法，并对该算法进行了简单介绍。通过对混合关联算法应用于安全管理平台的方式进行探索，提出了基于此算法的关联模块的设计方案。混合的关联算法应用于安全管理平台后，能够有效地融合相似告警，消除重复告警，实现了攻击场景的灵活再现，使得管理员不仅能从整体上掌握网络安全状态，而且能直观地做出决策，更好地维护网络安全。
위료해결안전관리중무효적중복안전사건이급사건지간독립분석적문제，수요대안전관리평태중적관련산법중신진행설계。결합당전안전관리평태병통과분석궤충관련산법적우렬성，종중선택료개솔상사도산법화선결조건산법작위연구대상，제출료일충기우량자적혼합관련산법，병대해산법진행료간단개소。통과대혼합관련산법응용우안전관리평태적방식진행탐색，제출료기우차산법적관련모괴적설계방안。혼합적관련산법응용우안전관리평태후，능구유효지융합상사고경，소제중복고경，실현료공격장경적령활재현，사득관리원불부능종정체상장악망락안전상태，이차능직관지주출결책，경호지유호망락안전。
As security management in security events are invalid and repeat and the analysisis independent,the correlation analysis algo-rithm of security operations center should be redesigned. Based on the development of the security management platform and the applica-tion of the correlation algorithm,a mixed algorithm is proposed and a scheme of correlation module based on the mixed algorithm is de-signed after analysis of the advantages and disadvantages of the correlation algorithm. After analyzing the mix algorithm,similar alerts are fused efficiently,the duplicate alerts are removed,and the attack episodes recur. In this scene,the administrators can know the security statement of the whole network which can help them make the correct decision-making and safeguard network security well.