Abstract:

Correlation analysis engine which correlate isolated security event as a chain to find out the real threat from a large number of false alarms or low level ones,is a key module of security operations centre（SOC）.The traditional correlation analysis mechanism is divided into two types:state machine and inference-engine.For poor precision and low efficiency,they don't adapt telecom network application.A new correlation analysis mechanism based on consecutive state by inference-engine was presented,which executed efficiently and accurately,to solve the problems of correlation analysis engine applied in telecom network.

Key words: security operations centre, correlation analysis engine, consecutive state, telecommunication network