The Analysis of Event Correlation in Security Operations Center

Many security events occur in computer networks and most of them are not isolated. In other words, there are many relationships among the events that are called redundancy relationship or causality. As the events are massive, correlation analysis is very important. This paper analyzes the current algorithm of event correlation and proposes a security events correlation method. This method unifies the security events from different security equipments and sorts them firstly, then combines the security events by the similarity, finally extracts correlation rules among security events utilizing data mining. It can decrease the number of alert, reduce false alert and discover high-level attack strategies.