Research Of Network Security Events Correlation And Design Of System

It can resolute network security problem partially or absolutely to set many types of network security devices (firewall, ids, vulnerability_scaner, etc) in network environment. However, it is arduous to analyze the security events generated by these devices. Correlation is an effective technology for security events analysis. It is the main task of this paper to analyze these security events and study the existing correlation model, correlation methods and design an effective, advanced network security events correlation system.In this thesis, after analyzing the achievement of the related field, we complete the following works:1. We present a model of security events correlation (SecModel) . With the model, we can analyze those security events effectively by filtering, aggregating, reconstructing, appraising of security event priority.2. We propose a correlation method for filtering security events. By virtue of the method, we can eliminate the false alarm in intrusion alerts to a certain extent, and discover the attack submerged all types of logs.3. We propose a correlation technique based on Fp_Growth algorithms for reconstructing security events. As a result, we can achieve the goal of reproducing multi_steps intrusion, and disclosing the tactic and logic process of attackers.4. The method for evaluating the priority of security events is proposed. We fix the priority of every event according to their harms to information system. With the arrangement of the priority from high to low, administrator could just pay attention to the more harmful events.5. We design and implement a system for security events correlation. The system is composed of three layers: security events collecting layer, correlating layer and managing layer. This system's function includes events collecting and generalizing, events filtering, events aggregating, events reconstructing, and the evaluating of events priority. In the end, we show that the security events correlation system is feasible and advanced in practice.