网络安全事件关联分析技术与工具研究

发布时间：2018-06-20 12:55

本文选题：关联分析 + 特征属性　；参考：《计算机科学》2017年02期

【摘要】：当前,以APT为代表的新型网络安全攻击事件频发并造成了巨大危害,其定制性、隐蔽性、持续性等特点使得传统攻击检测方法难以奏效。然而,随着大数据技术的日益发展,对各类安全相关事件及系统运行环境信息进行了有效关联,使得有效识别这类攻击和威胁成为可能,安全事件关联分析技术也随之应运而生。首先阐述了安全事件关联分析技术的重要性及其目标意义;然后对现有的安全事件关联分析技术进行了综述,从基于属性特征的关联分析、基于逻辑推理的关联分析、基于概率统计的关联分析、基于机器学习的关联分析等方面,分析描述了现有各种安全事件关联分析技术的机理及其优缺点;最后对现有的开源安全事件关联分析软件进行了综述,从应用场景、编程语言、用户接口以及关联方法等角度进行了综合比较。
[Abstract]:At present, the new network security attacks, represented by apt, occur frequently and cause great harm. The characteristics of customization, concealment and persistence make the traditional attack detection methods difficult to work. However, with the development of big data technology, various kinds of security-related events and system running environment information are effectively correlated, which makes it possible to identify such attacks and threats effectively. The security event association analysis technology also arises at the historic moment. Firstly, the importance of security event association analysis technology and its target significance are expounded, and then the existing security event association analysis techniques are summarized, which are based on attribute feature based association analysis and logical reasoning based association analysis. In the aspects of association analysis based on probability and statistics, association analysis based on machine learning, the mechanism, advantages and disadvantages of various security incident association analysis techniques are analyzed and described. Finally, the existing open source security event association analysis software is reviewed and compared from application scenarios, programming languages, user interfaces and association methods.
【作者单位】：信息工程大学;数学工程与先进计算国家重点实验室;
【基金】：国家自然科学基金(61501515)资助
【分类号】：TP393.08

【相似文献】