Abstract: The presentation is about network threat analysis accord to alert information of IDS and other network security devices in event correlation method. First some basic methods of event correlation was introduced, then a structure of event correlation analysis engine was discussed. Test result of demo system proved applying event correlation method on the threat analysis decreased the false positive and redundant alarm from network security devices.

摘要： 文章应用事件关联的方法综合IDS等安全设备报警信息进行网络威胁分析，介绍了事件关联基本方法，并提出事件关联分析器体系结构，实验系统测试结果表明，应用事件关联技术有效降低了网络威胁分析中出现的虚警，极大地减少了冗余报警。