Research of correlation engine technology based on security operation center
Xia Qing-guo · Jisuanji gongcheng yu sheji · 2007
Security operation center(SOC),as a platform of security information extraction,risk management and security decision,the whole capability of network system is elevated to security threats through the central arrangement of security policies,the deep sense of security events and the cooperative response of security components.In order to resolve the management of huge security data and high false positive of security events,correlation engine technology is researched depending upon the environment of SOC.The results of design,realization and test of correlation engine prototype based on rule correlation prove that correlation engine technology has been becoming an effective technique on resolving the management of huge security data and high false positive of security events,through unifying security data format and correlating security alerts.