Research and Application of Correlation Analysis in Security Management Platform
Ya Li · Computer Technology and Development · 2013
As security management in security events are invalid and repeat and the analysisis independent,the correlation analysis algorithm of security operations center should be redesigned.Based on the development of the security management platform and the application of the correlation algorithm,a mixed algorithm is proposed and a scheme of correlation module based on the mixed algorithm is designed after analysis of the advantages and disadvantages of the correlation algorithm.After analyzing the mix algorithm,similar alerts are fused efficiently,the duplicate alerts are removed,and the attack episodes recur.In this scene,the administrators can know the security statement of the whole network which can help them make the correct decision-making and safeguard network security well.