Acquisition and visualization of sensitive security audit events

Audit data analysis plays a critical role in the field of information security. Acquiring sensitive security audit events (SSAE) and visualizing correlations of them is an important task of audit data analysis and it is a very difficult issue. In this paper, we propose an approach to acquire SSAE and present their correlations in the form of graphs. Firstly, we use DWT (discrete wavelet transformation) to get sensitive security audit event objects, and then use DBSCAN (a clustering algorithm of KDD) and database query technique to obtain SSAE related to the sensitive objects. Secondly, a security audit event visualization model based on the theory of colored Petri-net is presented to visualize correlations of SSAE, and the acquisition process of causal relationship among audit events is given. Lastly, we carry out an experiment, which shows the proposed approach bring some convenience of browsing and analysing audit data to security auditor.