摘要
网络安全运营中心(SOC)是近年在国内外迅速发展的一种网络安全管理技术。提出了一个集安全信息采集、关联分析和响应控制于一体的闭环SOC体系结构,并对其实现过程中涉及的安全事件关联信息模型、事件实时风险评估等关键技术进行了深入的讨论。实现的SOC能够显著降低检测系统的漏警和误警率,对突发安全事件做出及时有效的响应,最小化网络风险。
Network security operations centre（SOC） is one kind of focal network security management technology in recent years.A closedring SOC architecture is proposed,which is composed of security event collecting,correlation analysis and response control phrases.Security event correlation information model and security event realtime risk assessment technologies involved in SOC implementation are investigated.The SOC implemented can dramatically reduces the rate of false positive and false negative of intrusion detection systems,efficiently react to emerging security events,and minimize network security risk.
出处
《计算机工程与设计》
CSCD
北大核心
2009年第9期2117-2120,2170,共5页
Computer Engineering and Design
基金
国防重点预研基金项目(9140A26010306JB5201)
关键词
网络安全运营中心
P2DR模型
安全事件
关联信息模型
事件实时风险评估
network security operations centre
P2DR model
security event
correlation information model
event realtime risk assessment
