Development of a Message Routing Method in SIEM Systems
摘要
This paper proposes a novel message routing method for security information and event management (SIEM) systems to address challenges in high-volume event processing and dynamic load balancing across distributed environments. The proposed solution introduces an algorithm for sending and routing messages (ASRM), which dynamically selects optimal broker nodes for message routing based on real-time metrics such as CPU load, network bandwidth, and latency. By employing a priority-based queuing system and a modular client-server architecture, the method significantly reduces message delivery times and prevents high-priority message blocking during peak loads. Experimental results demonstrate a 11.7% improvement in throughput and a 52.2% reduction in P99 latency compared to traditional Kafka-based systems. Additionally, the solution ensures efficient resource utilization, with a 25% reduction in CPU consumption for consumers. The study highlights the system’s scalability and robustness, making it suitable for industrial applications requiring real-time event processing. The findings underscore the potential of adaptive routing algorithms in enhancing the performance of distributed messaging systems under high-load conditions.