Computer networks have become ubiquitous and integral part of the nation's critical infrastructure. How to grasp the real-time overall situation of the network security is very noteworthy to study. Current network security systems make great contributions in enhancing the network security. Nevertheless, these products are independent and autonomous, so they fail to share the results of the detected attacks. Consequently, such solutions cannot figure out an overview of the network security situation. In another perspective, building a new global monitoring system from scratch will suffer from redundant construction, more cost, and longer deploying time. To address the dilemma, we propose a novel solution called GS-TMS which reuses the log data generated by the existing widely-spread security systems. By introducing the data stream and data integration technologies, GS-TMS provides a desirable capability of quickly building a large-scale distributed network monitoring system. Furthermore, GS-TMS has additional notable advantages over current monitoring systems in scalability and flexibility.
['Jiajia Miao']
GS-TMS: a global stream-based threat monitor system