The Research On Construction Of Enterprise SOC

In recent years, Security Operation Center (SOC) is one of the most popular direction in information security research area。A SOC is made up of five distinct modules: event generators, event collectors, message database, analysis engines and reaction management software. The main problem encountered when building a SOC is the integration of all these modules, usually built as autonomous parts, while matching availability, integrity and security of data and their transmission channels.The technical kernel of SOC is events relationship analysis modules, its main function is to filtrate,unite and analysis the security reports, then report the result to the manage module to take a reaction .This dissertation discussing several correlation analysis arithmetic, then invent a model of correlation analysis under the SOC structure.My works on the research of SOC are:1. Analysis of SOC theoreticFirst in this dissertation is the discussion of SOC structure, the work model and workflow of SOC. After describing the associate to other systems (NOC etc), we summarized the key technology of SOC, such as load balance,correlation analysis,vulnerability analysis and quick reaction.2. Events relationship analysis of SOCDescribing the concept and structure of events correlation analysis module, then compare the correlation arithmetic base on the knowledge base and the correlation base on no knowledge base. Invent a new SOC events correlation analysis module. After describing the structure of this correlation analysis module, discussing the research direction of SOC.3. Discuss method and steps of building a SOC Considering the experience of my job, Discussing the method and steps of SOC architecture, introduced two SOC projects case by the end of the dissertation.In conclusion, through the analysis about SOC theoretic and the study of correlation analysis, put forward a new events correlation analysis module. Describing real case of building SOC . I hope this dissertation will helpful on the enterprise SOC construction。...