A New Security Event Correlation Analysis Engine Based on Rule-Tree-Matching
Peng Lu, Ruobin Zhang, Guo Wu, Teng Hu · 2022 IEEE 5th Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC) · 2022
The magnitude of security data keeps increasing with the frequent occurrence of security events. And massive security data is causing increasing bottlenecks of correlation analysis engine in terms of matching efficiency, operating performance and rule expression, etc. In order to solve the above problems, this paper proposes a security event correlation analysis engine based on the Rule-Tree-Matching. The design and implementation of the security event correlation analysis engine have been completed. Also, several comparative experiments have been done to prove the advancement and feasibility of the Rule-Tree-Matching engine.