Security Operation Center Design Based on D-S Evidence Theory
Xuanzi Hu, Cunxi Xie · 2006
With the widespread application of large and complicated network, network safety has become an important issue. In this paper, a security operation center (SOC) concept based on multi-sensor data fusion technology is presented from the viewpoint of the network security. A structure of a SOC system based on D-S evidence theory is proposed, and the detailed method of data fusion in SOC is discussed. A prototype of SOC system is developed according to this structure of the SOC. Experimental results indicate that the SOC system based on D-S evidence theory can increase greatly the correctness of detection intrusion and decrease the rate of false positive