| Security audit is an important part of information security management and audit analysis is one of its significant contents. Audit events correlation analysis techniques and audit analysis visualization techniques are hot research fields of audit analysis. Current audit events correlation techniques mainly aim at the reports of IDS, and the related algorithms are all have limitations to some extent in analysis capability, so they can not achieve the goal of correlating audit events of other types or reconstructing events scenario. Also, current audit analysis visualization techniques mainly aim at the graphing of basic audit information and statistical information, lacking researches on the visualization theory model and the mechanism of acquiring sensitive security audit events, so they can not give visualized correlation analysis results for sensitive security audit events.For above problems, this paper deeply researches the related techniques with the topic of security audit events visualized analysis, and the main works are as follows:1 Uniformly describes security audit events in the expression of UML with the object oriented idea, which establishes the theory base for uniformly analyzing different types of audit events and visualized correlation analysis.2 Proposes a security audit event visualization model VAUDIT using the theory of colored Petri-net. This model can do correlation analysis in the aspect of causal relationship and can map the audit events from text to the graph.3 Proposes a security audit events visualized correlation analysis framework. In the framework, the paper proposes acquiring sensitive event objects based on DWT, and acquiring sensitive events based on DBSCAN clustering algorithm and Database query technique, lastly achieving the visualization of correlation for sensitive security audit events with VAUDIT.4 Implements and verifies the proposed framework using the audit data from a monitoring network system environment. The experiment results showed that the framework is of high feasibility and effectiveness.From the above work, the security audit event visualization model and visualized correlation analysis framework which the paper have proposed provide useful complementation and expansion for the related theory of security audit analysis, also, the application of this technique provides convenience and assistance of browsing and analyzing audit data for security auditor. |
