Towards identifying true threat from network security data

  • Authors:

  • Zhi-Tang Li;Jie Lei;Li Wang;Dong Li;Yang-Ming Ma

  • Affiliations:

  • Computer Science Department, Huazhong University of Science and Technology, Wuhan, Hubei, China;Computer Science Department, Huazhong University of Science and Technology, Wuhan, Hubei, China;Computer Science Department, Huazhong University of Science and Technology, Wuhan, Hubei, China;Computer Science Department, Huazhong University of Science and Technology, Wuhan, Hubei, China;Computer Science Department, Huazhong University of Science and Technology, Wuhan, Hubei, China

  • Venue:
  • PAISI'07 Proceedings of the 2007 Pacific Asia conference on Intelligence and security informatics
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Among the challenges in the field of network security management, one significant problem is the increasing difficulty in identifying the security incidents which pose true threat to the protected network system from tremendous volume of raw security alerts. This paper presents our work on integrated management of network security data for true threat identification within the SATA (Security Alert and Threat Analysis) project. An algorithm for real-time threat analysis of security alerts is presented. Early experiments performed in a branch network of CERNET (China Education and Research Network) including an attack testing sub-network have shown that the system can effectively identify true threats from various security alerts.