论文信息 - The Global Synthetical Processing of Network Security Events

The Global Synthetical Processing of Network Security Events

This paper presents the global synthetical processing of network security events in network security intelligent centralized management system, which aims to build up an integrated management platform for security events management. The system framework and many processing methods are introduced in this paper. The experiment has shown that the processing process can efficiently reduce the amount of security events and improve the quality of security events.

[1] Zubair A. Shaikh,et al. A platform independent approach for mobile agents to monitor network vulnerabilities , 2005 .

[2] Christopher Krügel,et al. Comprehensive approach to intrusion detection alert correlation , 2004, IEEE Transactions on Dependable and Secure Computing.

[3] Dario Forte. The “Art” of log correlation , 2004 .

[4] Frédéric Cuppens,et al. Alert correlation in a cooperative intrusion detection framework , 2002, Proceedings 2002 IEEE Symposium on Security and Privacy.

[5] Li Jing-hua. Mobile Agent Technology Development: A Survey , 2006 .

[6] Hervé Debar,et al. Aggregation and Correlation of Intrusion-Detection Alerts , 2001, Recent Advances in Intrusion Detection.

[7] Ichiro Satoh. Mobile Agent Technology , 2001 .

[8] Z.A. Shaikh,et al. Vulnerability assessment through mobile agents , 2004, E-Tech 2004.

[9] Stephen W. Neville,et al. Necessary conditions for determining a robust time threshold in standard INFOSEC alert clustering algorithms , 2005, 2005 IEEE International Conference on Systems, Man and Cybernetics.

[10] Alfonso Valdes,et al. A Mission-Impact-Based Approach to INFOSEC Alarm Correlation , 2002, RAID.

[11] Dong Li,et al. An Intelligent Agent-Oriented System for Integrating Network Security Devices and Handling Large Amount of Security Events , 2007, PAISI.