加权最近邻聚类在SOC中的应用

本文对网络安全管理中心（SOC）的报警技术进行了研究,提出了一种具有权值的最近邻算法的聚类方法,对经过初步过滤、规范化后的报警信息与知识库中已有规则进行聚类,获取真正的攻击事件并完成攻击场景的重构,对报警信息进一步进行关联分析提供了有力保障。通过测试及应用表明,本文所应用的方法在可用性、灵活性、获取攻击事件的准确性以及处理效率上要优于其它方法。

The weight value of the nearest neighbor clustering in SOC application

The alarm technology of Security Operation Center（SOC） is studied,Presents a kind of the clustering method based on the weighted of nearest neighbor clustering,after an initial filtering,normalization of alarm information and knowledge base of existing rules clustering,get real attack and attack scene reconstruction,the alarm information further correlation analysis provides a strong guarantee.The testing and application indicated that our method performed slightly better than other similar method in usability,flexibility,veracity of getting real attacks and efficiency.