A New Security Event Correlation Analysis Engine Based on Rule-Tree-Matching

The magnitude of security data keeps increasing with the frequent occurrence of security events. And massive security data is causing increasing bottlenecks of correlation analysis engine in terms of matching efficiency, operating performance and rule expression, etc. In order to solve the above problems, this paper proposes a security event correlation analysis engine based on the Rule-Tree-Matching. The design and implementation of the security event correlation analysis engine have been completed. Also, several comparative experiments have been done to prove the advancement and feasibility of the Rule-Tree-Matching engine.