安全审计数据的综合审计分析方法

Audit data analyzing approach for security audit system

随着计算机和计算机网络的应用普及,网络安全问题也日益突出,安全审计是网络安全体系中的重要一环,它在一定程度上弥补了防火墙和入侵检测的不足。介绍了一个安全审计系统的总体结构,对审计系统中收集到的一些信息进行分类后,重点讨论了如何对分类后的审计数据进行分析与处理,并在实际环境中进行了仿真测试。

Network-based computer systems are playing increasingly important roles in modem society. Since they become the target of intrusions by potential intruders, network security is becoming a challenge. Because firewall and intrusion detection system cannot provide entire solution, network security audit system is becoming important parts in security solution. Therefore, the architecture of a security audit system is introduced at first, then all audit data are classified into three classes. Finally, data analyzing and processing methods are discussed with some experiments and some simmlations are conducted.