Research of Security Event Correlation Based on Attribute Similarity
Zhaojun Gu, Li Yong · IC3T '12 Proceedings of the 2012 International Conference on Convergence Computer Technology · 2012
Aiming at the problem that there are a great deal of redundant security events in current network security systems, this article proposed a security event correlation algorithm based on the attribute similarity of mixed data type. For the event attributes, the algorithm respectively defined the similarity measure functions, gave attribute similarities different weights, and set different expected threshold values. The similarity between events depends on the attribute similarities, and then the correlation result lies on whether the similarity between the security events is larger than the expected threshold value. Experiments show the algorithm can effectively reduce redundant security events.