With the rapid development of information technology

enterprise and orgnizations are suffering different kinds of cyber security threats.Security Information and Event Management (SIEM) is playing an essential role in finding insider threats

suspicious behaviors or other advanced attacks based on its correlation capability.The SIEM detection capability relies on accurate and reliable correlation rule

however

traditional way of generating rule depends on human expert knowledge

which is costly and time consuming with low efficiency.In this paper

we propose an adaptive rule generation framework to generate correlation rule automatically.First

in order to identify unknown attack in a better way

we propose a security event classification algorithm based on One-Class Support Vector Machine (One-Class SVM) to classify security events effectively

and results show that classfication rate reaches as high as 97%.Secondly

for purpose of improving rule generation accuracy rate

we propose and optimize Genetice Programming (GP) rule generation algorithm by redefining individual structure

cross and mutation operation

and results show that best individual fitness reaches as high as 94%.Experiments have been performed and results show that our approach has the ability of self-adaption to identify unkown attack

a competitive threat detection accuracy rate as well as reducing human labor engagement.We also implement our approach to a real production system and more attack type could be detected compared with existing system.