The design of a correlation analysis engine model based on Carma_VE algorithm
Zhaoyang Qu, Wang Lei · 2009
SOC (security operation center) is the core platform of safety management system, and correlation analysis engine is the core of SOC. This paper designs a correlation analysis engine model. The engine can not only effectively eliminate or reduce duplicate and redundant alerts, but also quickly discover the hidden attack tactics in the huge amount of alerts generated by multi-step attacks. Based on the engine, Carma_VE algorithm is presented in order to automatically generate association rules. Compared with the Carma algorithm, Carma_VE algorithm is more efficient under the smaller training set.