Association analysis system based on event chains

Abstract

The invention discloses an association analysis system based on event chains. The association analysis system comprises an expression executing engine, an association analysis engine, an aggregation engine and an alarm engine, and the four parts are combined together to execute rules in a rule base. The expression executing engine executes expression parts of the rules and judges whether events meet the expression or not according to the events and the expression; if yes, the events are sent to the association analysis engine; according to association conditions, the association analysis engine finds association relations among all the events to form the event chains, and after being formed, the event events are sent to the aggregation engine; according to aggregation conditions, the aggregation engine aggregates the event events which can be aggregated to form final high value event events and sends the final high value event events to the alarm engine; the alarm engine gives an alarm according to the event events and executes related follow-up operation. The association analysis system can execute the rules in the rule base and meet requirements in various aspects. The whole system can completely perform concurrent execution in a internal storage and reach very high performance.

Description

technical field [0001] The present invention relates to the fields of network security and information systems, and in particular relates to an event chain-based correlation analysis system. Background technique [0002] Correlation analysis means that if there is a certain correlation between two or more events, one of them can be predicted by other things. Its purpose is to mine the hidden relationship between data. [0003] Most of the existing correlation analysis technologies and methods require that the events for correlation analysis have a clear sequence, so that events can be correlated and analyzed, otherwise the rules cannot be matched, resulting in missed events. For example, "A State Machine-Based Security Monitoring Correlation Analysis Method" (application number: 200910243576.X) discusses a state machine-based correlation analysis technology, which can detect the interaction between security events with time sequence , as described in claim 1 of the patent. ...

AI Technical Summary

Problems solved by technology

In order to solve the problem of timing disorder between events, it may be possible to configure two rules with opposite timing in the literature. However, if complex associations are performed, the number of rules will increase in series, which will have a serious impact on system performance.

Images