Network security incident correlation method

Abstract

The invention discloses a network security incident correlation method. The network security incident correlation method includes classifying original security incidents to respectively acquire attribute values such as IP addresses, port numbers, timestamps, original security incident classifications and alarming contents of the original security incidents, judging similarities of different original security incident attribute values, correlating the original security incidents according to similarities among the original security incidents, and correlating internally-related super alarms. The network security incident correlation method has the advantages that network security incidents are clustered according to the similarities among the original security incidents, and accordingly, the internally-related super alarms can be well correlated.

Description

technical field [0001] The invention belongs to the technical field of computer information security, and relates to a post-processing method for an intrusion detection system, in particular to a method for automatically finding the correlation between original security events generated in the intrusion detection system and obtaining super-alarm information. Background technique [0002] As a network security device, an intrusion detection system is deployed to notify administrators of threats to network services and data. However, the output of an intrusion detection system is considered low-level because a relatively simple attack can be attacked by multiple original security devices. This makes the analysis of intrusion alarm information very difficult: administrators need to try to reconstruct the entire attack pattern composed of potential attacks from the collected alarm information, and the collected information must include some false information. alarm information. ...

AI Technical Summary

Problems solved by technology

In order to maintain the correct rule base, it takes a lot of work. When the attack method changes, more new rules need to be maintained, and many old rules will become redundant rules; To a certain extent, it affects the execution efficiency of the system, and when there are too many redundant rules, the system performance will drop significantly

[0007] 2. Statistical correlation methods cannot explain the results of classification in the process of completing event correlation

[0018] The Chinese patent "Network Security Event Correlation Analysis System" with application number 201010613751.2 only forms a framework for security event collection and communication processing, and does not involve specific implementation methods

Images