Research and Realization of Security Events Correlation Framework
Zhong-Liang Zhang · Computer Knowledge and Technology · 2008
Based on the correlation technique on the basis of prerequisites and consequences of attacks,we research and realize a Distributed framework of real-time collection and correlation analyzing multiple-source alerts. The elementary experiment indicates that the framework can reduce and analyze alerts effectively,and help the administrator find out the valuable information.