ProSPer:一个支持proactive特性的通用型事件监控系统

大规模网络安全监控应用中需要对网络安全态势进行动态评估,在网络出现重大安全风险前进行proac-tive特性的有效防范.把网络安全监控系统建模为事件监控系统,对满足复合时序和属性值逻辑关系的多个事件进行关联,把多个原子事件复合为语义更丰富、更抽象的复合安全事件.已有研究提出了不同的复合事件检测模型,但缺乏proactive的事件监控能力.基于时序关系并不能提高事件监控的预测能力的假设.设计了基于top-k复合事件检测模型的事件监控系统ProSPer,为网络安全监控等应用系统提供proactive特性的事件监控能力.与已有的复合事件检测系统相比,ProSPer检测复合事件时无需读取全部成分事件,这种proactive特性是非常有意义的设计.

ProSPer:A Proactive Event Monitor for General Purposes

Network security monitor of large scale demands dynamic,continuous evaluation of security situation,proactive protection against approaching network risks.If the authors model security monitors as continuous Event Monitor Systems,that is to say,to correlate multiple events in complex temporal relationship and attribute logic relationship to richer semantic,more abstract complex event in security domain.Much works has studied to design complex event detection model but they lack the proactive capability to m...