关联分析算法在安全管理平台中的研究与应用

Research and Application of Correlation Analysis in Security Management Platform

为了解决安全管理中无效的重复安全事件以及事件之间独立分析的问题,需要对安全管理平台中的关联算法重新进行设计。结合当前安全管理平台并通过分析几种关联算法的优劣性,从中选择了概率相似度算法和先决条件算法作为研究对象,提出了一种基于两者的混合关联算法,并对该算法进行了简单介绍。通过对混合关联算法应用于安全管理平台的方式进行探索,提出了基于此算法的关联模块的设计方案。混合的关联算法应用于安全管理平台后,能够有效地融合相似告警,消除重复告警,实现了攻击场景的灵活再现,使得管理员不仅能从整体上掌握网络安全状态,而且能直观地做出决策,更好地维护网络安全。

As security management in security events are invalid and repeat and the analysisis independent,the correlation analysis algo-rithm of security operations center should be redesigned. Based on the development of the security management platform and the applica-tion of the correlation algorithm,a mixed algorithm is proposed and a scheme of correlation module based on the mixed algorithm is de-signed after analysis of the advantages and disadvantages of the correlation algorithm. After analyzing the mix algorithm,similar alerts are fused efficiently,the duplicate alerts are removed,and the attack episodes recur. In this scene,the administrators can know the security statement of the whole network which can help them make the correct decision-making and safeguard network security well.