An Improved Event Scenario Correlation Method for Multi-Source Security Log
Qianyun Wang, Shuyu Chen, Hancui Zhang, Tianshu Wu · International Journal of Security and Its Applications · 2016
Developing computer technologies and a network of persistently growing size put massive hosts and transmission devices in a vast network at increasingly higher risks.Log information of various devices can facilitate the detection of intrusion and attacks.Log information from a single data source is, however, with limitations.The analysis results cannot precisely reflect the current network situation if log information in a single data source is analyzed without correlation to analysis of log information from different data sources.To better demonstrate network situation, this paper proposes an improved event scenario correlation method for multi-source log analysis via researching on numerous existing data fusion methods and event correlation methods as well as integration of conventional event scenario correlation (ESC) method with fuzzy reasoning.Experimental results prove that the proposed method significantly reduces the False Positive rate (FP rate) and False Negative rate (FN rate) of security logs.