电信网络海量安全事件关联分析引擎技术研究

Correlation Analysis Approach About Numerous Security Information and Event in Telecommunication Network

关联分析引擎通过把孤立的安全事件集合关联为一个安全事件链,从大量误报告警与低级别告警中找出真正威胁告警,是安全运营中心分析安全态势、做出及时响应的关键技术模块。提出了一种结合状态机与推理机两类关联分析机制优点的关联分析引擎技术——基于序列状态推导的关联分析引擎,通过自动序列控制攻击场景规则的匹配,实现高效准确的海量安全事件的关联分析,能够较好地解决传统关联分析引擎在电信级网络应用中的问题。

Correlation analysis engine which correlate isolated security event as a chain to find out the real threat from a large number of false alarms or low level ones,is a key module of security operations centre （SOC）.The traditional correlation analysis mechanism is divided into two types：state machine and inference-engine.For poor precision and low efficiency,they don＇t adapt telecom network application.A new correlation analysis mechanism based on consecutive state by inference-engine was presented,which executed efficiently and accurately,to solve the problems of correlation analysis engine applied in telecom network.