1 / 15

Atropos Correlation Prototype

Atropos Correlation Prototype. COMP 415, Spring 2008. Table of Contents. Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo. Data Parsing. Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo. Data Parsing.

martha-ayala
Download Presentation

Atropos Correlation Prototype

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. AtroposCorrelation Prototype COMP 415, Spring 2008

  2. Table of Contents • Data Parsing • Matches • Correlation Strategies • Correlation Rulesets • Conclusion & Demo

  3. Data Parsing Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo

  4. Data Parsing • Transform raw data Log String: 846739 12-13-09 17 5000 AAB

  5. Data Parsing • Transform raw data • Log Parser or API JPM Service Atropos API API Call To Correlation Engine Parser Log File API Call

  6. Matches Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo

  7. Matches • Single correlation point • One or more parameters Match One Match Two

  8. Correlation Strategies Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo

  9. Correlation Strategies • One or more matches • Strength is “sum” of matches • Multiple strategies

  10. Correlation Rulesets Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo

  11. Correlation Rulesets • One link in association graph • Matches • Strategies • Data structures • Corollary: Parsing Rules

  12. Conclusion & Demo Data Parsing Matches Correlation Strategies Correlation Rulesets Conclusion & Demo

  13. Conclusion - summary • Matches link messages • Strategies compose Correlation • Rulesets map to network

  14. Conclusion - questions • How efficient is matching? • How to match w/o rules? • How to match substrings?

  15. AtroposCut through the tangled web… Thank You For Listening!

More Related