Dissertation > Excellent graduate degree dissertation topics show

A Comprehensive Approach to Alerts Correlation in Network Security Management System

Author: XiaXue
Tutor: XiaoDeBao
School: Central China Normal University
Course: Computer Software and Theory
Keywords: Comprehensive correlation approach network security management alert verification causal correlation
CLC: TP393.08
Type: Master's thesis
Year: 2009
Downloads: 122
Quote: 0
Read: Download Dissertation

Abstract


In the field of network security, contradiction between network attackers and users goes on and on. Meanwhile, a great variety of tools and a mass of information make a high request for network security managers, especially when facing current trend of comprehensive attacks, with which traditional single security management modes fail to deal. And with increasing requirements of network users for intelligent security management, a new integrated solution for network security management, or in other words, network security management system has become a fashion.A network security management system is desired to realize centralized monitor, uniform policy management, intelligent audit and interaction among various security function modules. At the same time, Intrusion Detection System (IDS) has evolved as an important tool for network security monitor, while a remarkable development trend of network security management is the adoption of an IDS-centric correlation manner. But the detection mechanisms of traditional IDSs has weaknesses including too fine grain, isolated alarming, lack of environmental consciousness and high rate of fals alarms. As a matter of fact, researches on comprehensive alert correlation become a focus, aiming in collaborate many kinds of correlation methods for the sake of solving different kinds and differnet level alerts.This paper discusses issues related to the application of a comprehensive approach to alerts correlation in network security management system, which includes alerts normalization, alerts reduction, alerts verification and alerts causal correlation. After introducing each component of the comprehensive correlation approach respectively, this paper focus on the alerts verification and alerts causal correlation components in the comprehensive framework. Alerts verification aims at reducing the rate of false alarms using the heterogeneous contextual information. And using the knowledge base with prerequisite and consequence, alerts causal correlation is to find the inner sequence of low-level alerts which come from the alerts verification part.

Related Dissertations

  1. Provincial Examination Yuan of network information security system design and management of research,TP393.08
  2. Network Security Management Research on the Bad Behaviors of High School Student,G631
  3. Ice Based Network Security Management System’s Architecture and Communication Design,TP393.08
  4. Research and Design on an Alerts Merge Schme in Network Security Management System,TP393.08
  5. Research on Attack Scenarios Reconstructing Method Based on Causal Correlation and Probabilistic Correlation,TP393.08
  6. Research on Network Risk Evaluation Based on the Processed Attack Scenarios Reconstructing,TP393.08
  7. Using Fuzzy Cluster and Causal Correlation to Construct Attack Scenarios,TP393.08
  8. Design and Implementation of Data Collection Agent in Unified Network Security Management,TP393.08
  9. The Research and Implementation of Attack Model and Event Correlation Technology in Network Security,TP393.08
  10. Research and Design on Distributed Agent Framework for Log and Data Collection,TP393.08
  11. The Design and Application of Data-Network Security Management System Based on SOC,TN929.5
  12. Policy-based Adaptive Network Security Management Research and Application,TP393.08
  13. Campus Network Security Management System Based on SNMP and Syslog,TP393.18
  14. Research and Application of Network Security Monitoring and Management System,TP393.08
  15. Network Risk Assessment Research Based on Multi-Source Data Fusion,TP393.08
  16. High-extendibility-oriented MAS Modeling Methodology and Its Application in the Security Management System,TP399-C2
  17. Study of Unified Network Security Management Platform,TN915.08
  18. The Design and Implementation of Policy-based Network Security Management System,TP393.08
  19. Network Security Management Platform Based on Information Correlation,TP393.08
  20. The Technology of Misuse Action Detecion in Large-Scale Network,TP393.08

CLC: > Industrial Technology > Automation technology,computer technology > Computing technology,computer technology > Computer applications > Computer network > General issues > Computer Network Security
© 2012 www.DissertationTopic.Net  Mobile