Security Events Tracing Research Based on Drools
Shengjun Wei · Computers & Security · 2008
A kind of security events tracing method based on Drools was proposed. It not only compressed the large quantity of alerts generated by security monitoring system, but also traced the whole attack(operation) procedure. General model and correlation analysis model were constructed based on the Drools principle. Secondly, the detailed design tactics and the key technologies realization were provided.