New types of alert correlation for security information and event management systems - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

New types of alert correlation for security information and event management systems

Résumé

Current Security Information and Event Management systems (SIEMs) constitute the central platform of modern security operations centers. They gather events from multiple sensors (intrusion detection systems, anti-virus, firewalls, etc.), correlate these events, and deliver synthetic views of the alerts for threat handling and security reporting. However, as the number of security incidents, and thus the diversity of alerts received by SIEMs increases, the need for appropriate treatment of these alerts has become essential. Alert correlation has been proposed in order to alleviate this problem. Current alert correlation techniques provide a better description of the detected incident and a concise view of the generated alerts, reducing their volume and thus their processing time. Although such techniques support administrators in processing a huge number of alerts, they remain limited, since these solutions do not provide information about the attacker's behavior and the defender's capability in reacting to detected attacks. In this paper, we propose two novel alert correlation approaches. The first is based on policy enforcement and defender capability models; and the second is based on information security indicators. We therefore enrich the current state of the art in alert correlation techniques with complementary approaches
Fichier non déposé

Dates et versions

hal-01452817 , version 1 (02-02-2017)

Identifiants

Citer

Gustavo Daniel Gonzalez Granadillo, Mohammed El Barbori, Hervé Debar. New types of alert correlation for security information and event management systems. NTMS 2016 : 8th IFIP International Conference on New Technologies, Mobility and Security, Nov 2016, Larnaca, Cyprus. pp.1 - 7, ⟨10.1109/NTMS.2016.7792462⟩. ⟨hal-01452817⟩
104 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More