Research On The Model For Correlation Analysis And Influence Evaluation Of Network Security Event

With the popularization and development of Internet, the Internet has played animportant role in people’s life in recent years. While the Internet provides peoplewith more convenience, network security events influence the use of the network.Therefore, it is necessary to research on network security events, and to analyze thepropagation process and characteristics of events. It is also necessary to analyze therelationship between events to determine their hidden inner link, and to distinguishthe influence of different events on the network.This paper studies an algorithm to build the propagation path of security events,and proposes a model to optimize the routing log algorithm which can record andgather log of data transmitted by the router. We can build the propagation path andnode communication diagram of events at low space consumption with simulationdata.Since the applicable range of the existing correlation analysis algorithm islimited, we propose a similarity analysis algorithm based on space-time causality. Itcan analyze the correlation between events. From the perspective of time and space,we calculate the similarity between nodes of different events and determine thecausal relationship between events.The influence of security events can be evaluated by impact on the change ofthe network performance, or can be described by attributes of events. In this paper,we propose a bottom-up hierarchical model. The model uses performance change ofevery node and link to evaluate the influence of events. We also propose anevaluation model based on attributes of events. The model use scale and controlfrequency as botnet attributes; it uses diffusion speed as worm attributes; it usesdamage as DDoS attributes.We design a prototype system according to the algorithm and the modelproposed in this paper. The experimental result shows: firstly, the optimizationmodel based on routing log algorithm can build propagation path of event with lowspace consumption; secondly, by using similarity analyze algorithm based onspace-time causality, we can determine the inherent relationship between eventsaccurately; thirdly, we can evaluate the influence of events in different types, single event and correlated events accurately by using the influence evaluating model.