CAJ | 학술논문

在网络安全设备联动系统的运行过程中,网络安全产品,如防火墙、IPS等会产生大量独立的、原始的安全事件,这些事件不仅数量庞大,而且还具有较高的漏报率、误报率,使用户无法对危险事件及时地进行响应.基于关联分析的事件关联模型是解决此问题的一个有效的方法.通过简单地综述当前存在的关联规则,研究并实现了一个带有实时响应机制的层次化的事件关联模型.
재망락안전설비련동계통적운행과정중,망락안전산품,여방화장、IPS등회산생대량독립적、원시적안전사건,저사사건불부수량방대,이차환구유교고적루보솔、오보솔,사용호무법대위험사건급시지진행향응.기우관련분석적사건관련모형시해결차문제적일개유효적방법.통과간단지종술당전존재적관련규칙,연구병실현료일개대유실시향응궤제적층차화적사건관련모형.
In the operation process of the network security equipment interaction system, network security products, such as firewall, IPS will generate lots of independent, original security events, these events not only have a huge quantity, but also have high false negative rate and high false positive rate. As a result, it is difficult for users to make a timely respond for hazardous events. An effective way for solving this problem is the event correlation model based on correlation analysis. Through a simple review of the current association rules, this content researches and implements a hierarchical event correlation model with real-time response mechanism.