A novel real-time aggregation method on network security events

作者：Li Zhitang; Ma Yangming^*; Wang Li; Lei Jie; Ma Jie

来源：Kybernetes, 2011, 40(5-6): 912-920.

DOI：10.1108/03684921111142467

• Cybernetics
• Correlation analysis
• Network operating systems
• Data security
• Process management

Purpose - The purpose of this paper is to show how to ensure a real-time precise aggregation processing of network security events without difficultly determined parameters.
Design/methodology/approach - The aggregation method includes the choice of aggregation granularity, consistency of abstraction layer, the expression of all hyper security events (HSEs) of a node in cache, and aggregation algorithm based on classification, etc.
Findings - The aggregation method is capable to provide a real-time way for good HSEs for next correlation processing with weak and easy parameters to determine.
Research limitations/implications - The cost of space is not discussed in the method.
Practical implications - The aggregation method is suitable for real-time management of difficult issues to resolve massive security events.
Originality/value - Many ideas and concepts of the paper are proposed for the first time, such as the expression of all HSEs of a node in cache, weak queue length instead of the weak-time window and so on.

• 出版日期2011
• 单位华中科技大学