Application Of Event Correlation For The Security Management Of Next Generation Telecommunication Network

With the development of Next Generation Network (NGN), Telecommunication Network (TN) and internet are trend to be fused, the gateway to enter Telecommunication Network is widely open, security problem become more and more serious. Signaling System 7 is the key to the Telecommunication Network. Because the protocol of SS7 is completely open and it is short of security system, its network frangibility problem is obvious, attackers could use these to give Telecommunication Network a serious damage.First, by analyzing SS7 protocol, we find out weakness of it, and give out some possible attack methods. Then, based on network security management technology, we bring Event Correlation into Next Generation Telecommunication security management. Meanwhile, the implement of an Event Correlation Server is shown.The contributions of the paper are denoted as follow:1. Feasibility of Signaling System attackingNext Generation Telecommunication Network is fused with internet, so it is possible to use current network security management system as a reference. Signaling System 7 is the key to the Telecommunication Network, so we analysis all the layer of Signaling System 7, and give out attack methods.2. Improve event management of Telecommunication NetworkEvent correlation is key part to current network securitymanagement. Because Telecommunication Network is big complicated network, with all kinds of alert event, How to deal with these event well, is a really big problem, the contemporary event correlation algorithms are analyzed.3. Implement of Event Correlation ServerThe implement of a rule algorithm Event Correlation Server is introduced. It can supervise all kinds of security equipment by agent, and format alert event message. Also, it could eliminate redundant alert message from a event. Based on certain rule, it could analysis events from all equipments to find out attack.In the end of this paper, a Security Operation Center (SOC), which is used in current network security management, is described in detail. Based on feasibility of Signaling System attacking in this paper, Import certain security rules into this Event Correlation Server, the security management of Next Generation Telecommunication Network could be more efficient.