Method and system for correlation analysis of security events

Abstract

The invention relates to a method and a system for correlation analysis of security events. The method comprises the following steps that a security event record collected by a safe operation center is received; according to equipment grouping, an event sequence table, which is sorted according to the security event occurrence time, is formed, and a current analysis pointer points at a security event record, which does not enter a trigger, at the earliest time; the security event record, which is pointed by the current analysis pointer, is transmitted to the trigger to carry out rule matching of a state machine, and the current analysis pointer points at a security event record at the next time sequence; timing through a timer and state jump are carried out according to a rule matching condition of the security event records in the trigger, and equipment corresponding to the security event records in the trigger is counted according to an overtime condition of the state machine; and when a counting result is up to a threshold, the counting result is transmitted to a synchronous regulator, so that the synchronous regulator carries out step size adjustment on the event sequence table according to the counting result. According to the method and the system, precision requirements on correlation analysis of the security events under the complex network environment can be met.

Description

technical field [0001] The invention relates to network security technology, in particular to a security event correlation analysis method and system. Background technique [0002] In today's increasingly severe network security situation, network security management has become an important part of network operations. Security Operations Center (SOC) is a technical support platform for comprehensive analysis of network and security equipment and systems, and centralized management and monitoring of security events. The SOC collects security logs generated by devices and systems in the network, analyzes and processes them, and finds out the current security threats and potential security risks of the network, so as to issue early warnings in time to avoid heavy losses on the network. Among the large amount of security event information collected by the SOC from the network, many of them do not have real threats, some may be signs in the early stage of threat implementation, ...

AI Technical Summary

Problems solved by technology

In a complex network environment, due to the influence of network transmission delay and front-end processing delay, the timing of security events entering the engine may be reversed, causing the "state machine" to fail to trigger, and the correlation analysis engine to have false positives or false positives

Therefore, the analysis accuracy of existing correlation analysis engines is limited, and it is difficult to meet the requirements of correlation analysis in complex network environments.

Images