Correlation engine system based on scene and data processing method thereof

Abstract

The invention discloses a correlation engine system based on scene and a data processing method thereof, aiming at mainly overcoming the disadvantages of poor expansibility and flexibility in the existing security management centers. The system is mainly composed of a plug-in module and a core module; wherein the plug-in module realizes different functions of the correlation engine system by configuring and installing an event format expanding plug-in, an event collecting plug-in, a scene analyzing plug-in and a response output plug-in; the core module describes the whole attack process as an attack scene changing states continuously by a management center, is in charge of correlation analysis and processing on warning information reported by each detection sensor, and realizes cooperative work and uniform management of all the sensors. The invention has the advantages of flexible configuration, easy expansibility and high detection rate and is applicable for data processing and analysis of various security management centers and intrusion detection systems.

Description

technical field [0001] The invention belongs to the technical field of computer security protection, in particular to a scenario-based correlation engine system for processing security data generated by network equipment including routers, switches, firewalls, intrusion detection systems and servers. Background technique [0002] In recent years, the computer network has developed from being only a means of communication to a widely used computer environment infrastructure, especially the Internet, which has become an important network that governments, enterprises, financial institutions and thousands of users rely on. infrastructure. [0003] At the same time, the security monitoring and management of this computer network has also become an important issue. For a long time, people have used intrusion detection system IDS products to solve this problem. IDS monitors information on the host system or the network, and searches for network packets, operating system calls, au...

AI Technical Summary

Problems solved by technology

[0008] 1. Fixed source of events, lack of scalability;

[0009] 2. The static attack behavior detection mode cannot be dynamically loaded and expanded;

[0010] 3. The static response method cannot effectively meet the ever-changing needs of the user's network environment;

[0011] All kinds of existing network security management products are developed for specific application fields or environments, among which event collectors, behavior detection modes and response methods are all aimed at existing and specific security technologies to realize their monitoring, control and management Once a new security technology emerges or there are non-mainstream security requirements in the network environment, these new technologies can only be applied after being approved by the network security management product manufacturer and after product upgrades. It is difficult to configure, expand and remote control

Images