A New Security Event Correlation Analysis Engine Based on Rule-Tree-Matching

A New Security Event Correlation Analysis Engine Based on Rule-Tree-Matching

연구 분야: Safety

학회: 2022 IEEE 5th Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC)

The magnitude of security data keeps increasing with the frequent occurrence of security events. And massive security data is causing increasing bottlenecks of correlation analysis engine in terms of matching efficiency, operating performance and rule expression, etc. In order to solve the above problems, this paper proposes a security event correlation analysis engine based on the Rule-Tree-Matching. The design and implementation of the security event correlation analysis engine have been completed. Also, several comparative experiments have been done to prove the advancement and feasibility of the Rule-Tree-Matching engine.