| With the rapid development of the Internet,the ever-expanding network scale and the network security problems have posed serious challenges to daily life and enterprise operations.Network security event correlation analysis technology through the collection of multi-source security information,through normalized preprocessing,security event verification and aggregation and attack scenarios reconstruction to reduce redundant alerts and remove false alarms,through the establishment of algorithmic model to reconstruct the attack scenario is the core module in the field of situational awareness and has important research value.Therefore,this study designed a distributed security event correlation analysis system based on knowledge graph.Constructed the network security knowledge graph,designed the association analysis algorithm based on the graph,and implemented the distributed correlation analysis system by parallelizing the algorithm.The main work of this research has the following aspects:First,we design a network security knowledge graph model,including the four dimensions of basic asset dimension,vulnerability dimension,threat dimension and alarm dimension.Respectively define the entity attribute of each dimension,and then populate each dimension entity by extracting multi-source open source security knowledge,including the disclosed vulnerability database,system software repository,public attack pattern classification database and intrusion detection system alarm database model.And build a complete knowledge graph of network security by finding all the relationships between all the dimensions and using the Neo4 j diagram database.Second,based on the knowledge graph of network security that has been realized,a method of event correlation analysis based on scene matching is designed and implemented.The whole process of association includes security event pretreatment,security event verification and reconstruction of attack scene.Scenarios are modeled as a knowledge graph organization and represent hypersensitive alarms,security incidents,and vulnerabilities associated with the scene through the logical relationship of AND and OR.According to the logical result of the scene match to give the correlation result.Third,in order to meet the needs of big data processing,a distributed security event correlation analysis system is designed and implemented based on the design of correlation analysis algorithm.The system mainly constructs the real-time data analysis system by using a number of distributed frameworks and databases which are widely used at present.The system includes the data collection module,the merge distribution module,the real-time data analysis module and the storage module. |
