Research on Network Security Event Correlation Analysis Method Based on Knowledge Graph
Zhenwan Zou, Jun Yin, Shuming Fan, Xiaoyu Zhang · 2024
With the increasing development of big data technology, it is possible to identify various attacks and threats by correlating various network security events and related system information. Network security event correlation analysis technology has also emerged. This article first elaborates on the goal and significance of network security event correlation analysis technology, as well as the problems existing in existing network security event correlation analysis technology; Then, a network security knowledge graph was designed, which defines entity attributes from four dimensions: assets, topology, vulnerabilities, and alarms. Finally, based on the network security knowledge graph, a network security event correlation analysis method is proposed, and examples are given to illustrate that this method can accurately identify real alarms from multi-source network security alarm information.