Security Event Correlation Analysis Based on Plan Recognition
Liu Yu-na · Journal of Information Engineering University · 2015
Existing event correlation analysis technologies can not dispose the fragmentary and small quantity of audit event information effectively and accurately. To solve this problem,this paper proposes a security event correlation analysis framework and the corresponding algorithm based on plan recognition by using the plan recognition advantage of the disposing incomplete information. The proposed algorithm regards the system audit logs and the security state information as the audit event source,processes the origin events standardized by using the event analysis module,and completes event correlation reasoning by using plan recognition,thus improving the efficiency and precision rate of security event correlation analysis.