A correlation analysis method of network security events based on rough set theory

Network security event correlation can find real threat through correlating security events and logs generated by different security devices and can be aware of the network security situation accurately. This paper propose a network security events correlation scheme based on rough set, build database of network security events and knowledge base, gives rule generation method and rule matcher. This method solves the simplification and correlation of massive security events through combining data discretization, attribute reduction, value reduction and rule generation.