Abstract:

For the existing network security strategy in dealing with the alarm information, the calculation structure is single, resulting in long running time and low efficiency, this paper proposes a network security technology research based on multi-source alarm information correlation analysis. On the basis of clarifying the attack intention, the effective alarm information data is extracted, and the multi-source alarm information is aggregated and de redundant by association analysis algorithm; the alarm information management process based on association analysis rule matching is designed, and the network security technology platform is established to realize the network security technology research based on multi-source alarm information association analysis. The experimental results show that in the same running time, the number of alarm information is significantly reduced, and the network security alarm rate is improved.

Key words: multi source, alarm information, network security, multi source fusion, technical defense technology

摘要：

针对现有网路安全技防策略在处理告警信息时，计算结构单一，导致运行时间长、效率低，为此提出基于多源告警信息关联分析的网路安全技防技术研究。明确其攻击意图的基础上提取有效告警信息数据，通过关联分析的算法，对多源告警信息进行聚合、去冗余处理；设计基于关联分析规则匹配的告警信息管理流程，建立网路安全技防技术平台，实现基于多源告警信息关联分析的网路安全技防技术研究。实验结果表明，在同一运行时间内，告警信息数量明显减少，提高网路安全报警率。

关键词: