Towards Identifying True Threat from Network Security Data

摘要

Among the challenges in the field of network security management, one significant problem is the increasing difficulty in identifying the security incidents which pose true threat to the protected network system from tremendous volume of raw security alerts. This paper presents our work on integrated management of network security data for true threat identification within the SATA (Security Alert and Threat Analysis) project. An algorithm for real-time threat analysis of security alerts is presented. Early experiments performed in a branch network of CER.NET (China Education and Research Network) including an attack testing sub-network have shown that the system can effectively identify true threats from various security alerts.