Monitoring security events using integrated correlation-based techniques
暂无分享,去创建一个
We propose an adaptive cyber security monitoring system that integrates a number of component techniques to collect time-series situation information, perform intrusion detection, and characterize and identify security events so corresponding defense actions can be taken in a timely and effective manner. We employ a decision fusion algorithm with analytically proven performance guarantee for intrusion detection based on local votes from distributed sensors. The security events in the proposed system are represented as forms of correlation networks using random matrix theory and identified through the computation of network similarity measurement. Extensive simulation results on event identification illustrate the efficacy of the proposed system.
[1] Albert,et al. Emergence of scaling in random networks , 1999, Science.
[2] Feng Luo,et al. Constructing gene co-expression networks and predicting functions of unknown genes by random matrix theory , 2007, BMC Bioinformatics.
[3] Leonard J LaPadula. CyberSecurity Monitoring Tools and Projects: A Compendium of Commercial and Government Tools and Government Research Projects , 2000 .
[4] E. Wigner. Random Matrices in Physics , 1967 .