Different from the researches that using the signature based detection system, the proposed system used the correlation rules to analyze host log. When faced with malware that concealed in different processes, network managers can use a more comprehensive perspective to analyze the attack.

Proposed system uses the architecture of SIEM and uses correlation analysis and artificial intelligence that can reach
1. Ensure log integrity
2. The impact of host performance is less
3. Avoid Anti-VM or Anti-debugger

Using artificial intelligence and correlation analysis to capture the signature of the host behavior, the suspicious host and behaviors can be found in the early stage of the attack. Reduce the cost of human and financial after the attack were captured. Proposed system can be applied to campus networks, corporate networks, government networks.