中小企業在我國是佔比率最高的企業組織。但遇到資安問題，卻無法取得應有的服務。透過文獻分析法，找出適合中小企業，可行的迷你資安監控中心架構，並詳述處理方式與人員配置等細節。資安監控中心的人員調度、資安設備的投入、事故流程建立與應變，在預算、能力有限的中小企業裡，處理方式與大型企業完全不同，有限的時間、金錢與人力，今中小企業在選擇時必須有不同的角度。

本研究透過文獻討論所歸納的理論基礎進行分析，藉此討論適用於中小企業的迷你資安監控中心規劃與設計。將現有資安監控中心功能的拆解、重構，規劃出適合於中小企業的資安監控中心。

The small-sized enterprises (SMEs) are highest proportion of business organizations in Taiwan. However, when it comes to security problems, it cannot obtain the services it deserves. Through the document analysis method, find a feasible mini Security Operation Center structure for small-sized enterprises, and explained details the disposal process and staffing. The staffing and dispatching of the security operation center, the investment in the security equipment, and the establishment and adaptation of the accident process, in the small and medium-sized enterprises with limited budgets and capabilities, are handled in a completely different way from the large-scale ones. The limited time, money, and manpower are that SMEs must have different angles when choosing.

This document analysis basis on theoretical of the literature review and discusses the planning and design of mini- security operation center for SMEs. The dismantling and reconstruction of the existing and planning of a security operation center for SMEs.

行政院資通安全辦公室 (2013)，102年SOC參考指引(v2 0).
[2] 林怡伶 (2015)，數位鑑識實驗室認證系統導入之研究。國立臺灣科技大學研究所碩士論文，台北市。
[3] 傅雅萍，樊國楨、楊中皇(1997)，CORAS 用於ISAC之研究。台北市。

英文參考文獻

[4] Andreas M, (2009) Event Correlation Engine. Department of Information Technology and Electrical Engineering.
[5] Baoming T, Joanna H, Derek L. (2017) Reducing False Positives Of User-to-Entity First-Access Alerts for User Behavior Analytics. San Mateo, California.
[6] Bin Z, Ali A. (2005) Alert Correlation for Extracting Attack Strategies. Faculty of Computer Science, University of New Brunswick Fredericton, New Brunswick, Canada.
[7] Boris G, (1998) Integrated Event Management: Event Correlation using Dependency Graphs, Department of Computer Science, University of Munich. Munich, Germany.
[8] F. Cuppens and R. Ortalo, (2002) Lambda: A language to model a database for detection of attacks,” in Proceedings of Recent Advances in Intrusion Detection, 3rd International Symposium, (RAID 2000), LNCS 1907, pp. 197-216, Springer-Verlag, Toulouse, France
[9] Julia A, Derek G, Christopher M. (2003) Outsourcing Managed Security Services, Carnegie Mellon University. Pittsburgh, PA.
[10] Michael T. (2002) A Survey of Event Correlation Techniques and Related Topics. Georgia Institute of Technology. Atlanta, GA.
[11] Seyed A, Sajjad A, R.(2013) Alert Correlation Algorithms: A Survey and Taxonomy. Data and Network Security Laboratory Department of Computer Engineering, Sharif University of Technology. Tehran, Azadi Avenue.
[12] S. T. Eckmann, G. Vigna, and R. A. Kemmerer,(2002) Stalt: an attack language for state-based intru-sion detection. Journal of Computer Security
[13] TAN Shyh Hae, LEE Kok Thong, SEOW Nyi Matthew, TAN Choon How, (2016) Smart Network and Security Operations Center. Singapore.
[14] Tyler O, (2014) Threat Intelligence & SIEM. Lewis University. Romeoville, IL.