2KLIGER S, YEMINI S. A coding approach to event correlation[A].Proceedings of 4th International Symposium on Integrated Network Management (IFIP/IEEE) [C]. Santa Barbara, CA, 1995.
3GRUSCHKE B. Integrated event management: event correlation using dependency graphs[A].DSOM'98[C], 1998.
4HASAN M, SUGLA B, VISWANATHAN R. A conceptual framework for network management event correlation and filtering systems[A]. Proceedings of the Sixth IFIP/IEEE International Symposium on Integrated Management[C], 1999.
5LIU G, MOK AK, YANG EJ. Composite event for network event correlation[A]. Proceedings of IM'99[C], 1999.
6OHSIE D, MAYER A, KLIGER S, Event modeling with the MODEL language: A tutorial introduction[EB/OL], http://www. smarts.com/resources/code-tpapers-model.pdf, 2004 - 12.
7CUPPENS F, MIEGE A. Alert correlation in a cooperative intrusion detection framework[A]. Proceedings of the 2002 IEEE Symposium on Security and Privacy[C], 2002.
8GULA R. Correlating IDS alerts with vulnerability information[EB/OL]. http://www. tenablesecurity. com/white-papers/va-ids. pdf,2004 - 12.
9DEBAR H, WESPI A. Aggregation and Correlation of Intrusion-Detection Alerts[A]. RAID 2001, LNCS 2212[C], 2001. 85 - 103.
10LEE W, STOLFO SJ. A framework for constructing features and models for intrusion detection systems[J]. ACM Transactions on information and system security, 2000, 3(4) : 227 - 261.
5Cisco.Cisco Security Monitoring,Analysis and Response System[EB/OL].http://www.cisco.com/en/US/products/ps6241/products_ data _sheet0900aecd80272e64.html.2006.
6赵丽华;卢旭英.网络实时监控系统的设计与实现[J],NetSecurity Technologies and Application2001(08).
