Computer networks have become a ubiquitous and integral part of the nation's critical infrastructure. In this paper,we propose a novel solution called GS-TMS (Global Stream-based Threat Monitoring System) which reuses the log data generated by the existing widely-spread security systems. Based on the data stream and data integration technologies, GS-TMS provides a desirable capability in quickly building a large-scale distributed network monitoring system. Furthermore, GS-TMS has additional notable advantages over the current monitoring systems in scalability and flexibility.%本文基于数据集成和数据流技术,提出一种网络威胁监控框架.该框架复用底层IDS、FireWall、NetFlow等系统的监控日志,将安全日志转换为该系统的数据流输入,通过模式映射屏蔽各异构系统的日志异构,使得用户能够在全局视图上进行网络事件查询.该框架的优势在于:(1)复用已有安全日志,避免重复部署网络探测器;(2)使得各分布式系统之间的监测结果能够共享;(3)基于数据流的查询技术能够保障监控的及时性和连续性;(4)通过实验验证了系统良好的扩展性和适应性.
展开▼
