NORX is an authenticated encryption scheme introduced by Jean-Philippe Aumasson in 2014 as a candidate of the CAESAR competition. It is based on sponge structure which supports an arbitrary parallelism degree. The only operations used in the core permutation of NORX are AND, rotation, XOR and shift, called LRX construction, which improves hardware efficiency and simplifies cryptanalysis. To study the cryptographic properties of the core permutation is essential for its security evaluation. NORX consists of two variants denoted as NORX32 and NORX64, which provide128-bit security and 256-bit security respectively. There have been a few analysis results such as differential, higher differential and guess and determine cryptanalysis but no linear cryptanalysis has been found so far. In this paper, we start from the linear properties of basic function H, use probabilistic bits to analyze the simplified version of function H and get its bitwise probability distribution. Then we propose a fast computing algorithm to compute the correlation coefficient of H function. Depending on the algorithm, we derive the structure of correlation coefficient of H function. Furthermore, we analyze the function component of H in NORX, then derive a necessary and sufficient condition on input and output masks when linear approximation has nonzero-correlation. Based on the property that single input mask determines single output mask when the correlation coefficient is nonzero, we derive some nonzero-correlation properties on the core permutation function G. These analysis results can be a basis for further linear and zero-correlation linear cryptanalysis of NORX.