Temporal and spatial distributed event correlation for network security

Computer networks produce large amount of event-based data that can be collected for network security and management analysis. Computer networks are dynamic systems and network events are the observable of their dynamic activities. Evidence of attacks against a network and its resources is often scattered among these distributed events. Therefore, a critical challenge is to correlate these events across observation space and time to detect various attack scenarios. This paper analyzes how control and estimation methods can be applied to correlate distributed events for network security. Based on those methods, a process query system has been implemented which can scan and correlate distributed network events according to users' high-level description of dynamic processes.