Abstract: The article presents the architecture of enterprise security management center (ESMC) based on log mining which is distributed and supports multi-protocol. It can collect, normalize and aggregate the massive and various log information, generate the consolidating notifications, analyze the notifications by the checking model to find the potential compromises and attacks in the system, take real-time response actions. Finally, the paper describes how to build the checking model by data mining.

摘要： 提出了一个基于日志挖掘的、分布式、多协议支持的企业安全管理中心框架,介绍了其组成和实现。描述了利用数据挖掘技术产生检测模型的过程。通过对各种日志信息进行采集、规整和汇集,生成统一的通告事件,利用检测模型进行分析,从而发现系统中的潜在威胁和攻击,采取实时应对措施。

关键词: 日志, 数据挖掘, 事件关联, JMX规范

CLC Number: 

• TP311.13