Network security correlation analysis method based on complex event processing

Abstract

The invention belongs to the field of network security technologies, and particularly relates to a network security correlation analysis method based on complex event processing. Different events from different network even sources are correlated and analyzed. According to the network security correlation analysis method, threatening influences on a whole network by security events and considerations given to importance of directly attacked equipment or software are taken into account, multi-level analysis is performed on security events generated by serial operation on the same object through a multi-level rule, and all security event risk values can be accumulated to achieve the purpose of integrally analyzing the object. The multi-level correlation matching mode is adopted, on one hand, the network security correlation analysis method meets the requirement of the logic mode that an attacker generally needs multiple steps when initiating attacks, on the other hand, risk accumulation summation is performed on the multiple events, and complex relations between the events are comprehensively considered. In this way, potential threats in the network are easily detected so that early warning and processing can be performed to protect the network.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a network security association analysis method based on complex event processing. Background technique [0002] The rapid development of the network has brought many troubles to people while facilitating people's lives. With the continuous expansion of network scale, network attacks and sabotage behaviors are becoming more and more frequent, and the network security situation is becoming increasingly severe. Although there are layers of protection from hardware to software in the network, in general, these measures alone still cannot accurately and timely discover various attacks launched by attack targets. Especially in a complex network environment, if an attacker has already obtained some information, it is easy to obtain more important information by forging or using a small amount of information to test. Many security events related to this behavior often have int...

AI Technical Summary

Problems solved by technology

[0007] The complexity leads to low execution efficiency, which is not conducive to timely analysis of the current network security situation

Images