Study on data acquisition solution of network security monitoring system

摘要

With the demands for network security, some heterogeneous security equipments such as firewalls, intrusion detection systems, and anti-virus gateways are widely deployed in network, and produce massive security events which need to be merged and analyzed. Therefore, a distributed and multi-protocol supported network security monitoring system is proposed. The paper describes the architecture of the network security monitoring system. Focusing on the system acquisition layer, two methods are designed for monitoring data collection: syslog-based collection and real-time traffic-based collection. The ActiveMQ which based on the JMS specification was adopted for data transmission…