A Redundancy Removal Method Based on Multi-source Alarm Log Security Event Characteristic Analysis

Abstract

The invention discloses a redundancy removal method based on multisource alarm log security incident feature analysis, belongs to the technical field of information security, and overcomes the technical problem in the prior art that a redundancy removal scheme can not effectively cluster alarms, may delete alarms by mistake or does not consider that the weight distribution of similarity calculation is regulated according to attribute dependency. The redundancy removal method based on the multisource alarm log security incident feature analysis successively comprises the following steps: (1) discretizing alarm log attributes; (2) dynamically distributing an alarm incident attribute weight; (3) calculating an alarm security incident similarity; and (4) judging whether the alarm security incident is redundant or not.

Description

technical field [0001] The invention relates to a redundant de-redundancy method based on multi-source alarm log security event feature analysis, and belongs to the technical field of information security. Background technique [0002] With the diversification and complexity of network threats, a single-function network security product cannot guarantee the security of information systems. Therefore, we have installed security products such as firewalls, intrusion detection systems, and identity authentication systems in the network. While these security products have improved the security level of the system, they have also brought new problems: there is a large amount of redundancy in the multi-source heterogeneous massive security events generated by different security products, and the data is difficult to be efficiently processed and analyzed. [0003] The method of alarm aggregation can effectively reduce the number of alarms, so that attack events can be presented mo...

AI Technical Summary

Problems solved by technology

While these security products have improved the system security level, they have also brought new problems: the multi-source heterogeneous massive security events generated by different security products have a lot of redundancy, and the data is difficult to be efficiently processed and analyzed

[0004] 1. The attributes selected for comparison are too scattered, and some schemes do not consider the alarm time attribute, which cannot effectively aggregate alarms;

[0005] 2. Different types of alarms contain targeted information, and the same algorithm and threshold are used for alarm aggregation, and alarms may be deleted by mistake;

[0006] 3. Specific types of alarms have a strong dependence on certain specific attributes, such as DOS type and target IP port. In existing solutions, the problem of adjusting the weight distribution of similarity calculation based on attribute dependence is rarely considered.

Images