摘要
针对目前安全事件采集数据格式不统一,且需要通信的安全事件数目过多等不足,提出应用于数据采集代理端的数据解码技术和安全事件分析技术。数据解码技术主要对安全事件数据进行解码,从而使不同的安全事件具有相同的格式。安全事件分析技术主要对解码后的安全事件进行过滤和关联,实现一个简单的分布式安全事件采集系统,并对所提出的两类技术进行了测试。测试结果表明,这两类技术能够较好地应用于安全事件采集代理端。
Given there are the deficiency of security events data acquisition in uniform data format and too many items of the events to be transmitted, etc. , we propose in this paper the data decoding technique and security events analysis technique used at data acquisition agent. The data decoding technique is mainly used to decode the data of security events, therefore different security events will have the same data format. The security events analysis technique is mainly used to filter and associate the security events decoded. In the paper we present the implementation of a simple distributed security events acquisition system, as well as the tests on two techniques proposed. Test results show that these two techniques can be used well at security events acquisition agent.
出处
《计算机应用与软件》
CSCD
北大核心
2012年第12期309-314,共6页
Computer Applications and Software
关键词
安全事件
数据采集
数据解码
Security event Data acquisition Data decoding
