A distributed framework for security operation center in the application of Institute of High Energy Physics

Abstract

Security operations centers (SOCs) standardize what SOCs do. Most SOCs are designed as a centralized mode which serves for single organization. The single-organisation SOCs face structural challenges in addressing operational security scenarios where the incidents span muliple organisations, and where these organsiations habitually deliver services in a synergistic way. In this paper, we propose the distributed security operation center (DSOC) that provides the distributed working mechanism for multiple organizations over the wide area network by combining their security probes. The security probes of DSOC are deployed in the different organizations to collect data and the collected data is transferred over wide area network to the data analysis center of the DSOC. Especially, the data communication between security probes and data analysis center is encrypted to ensure the data security of every organization. The data analysis center adopts rulebased, AI-based and threat intelligence-based algorithms to detect cyber-attacks. The detection results are input into the automated response module in the DSOC. The automated response module is the client-server structure and the client are installed in the security probe. The server of the automated response sends commands across the wide area network to the target client of the security probe to block the attackers quickly, and meanwhile the communication between client and server in the response processes is encrypted. In addition, the threat intelligence component of DSOC can aggregation intelligence from the organizations and easily share this intelligence with all organizations based on the distributed security probes. The DSOC also builds the security situational awareness system that visualizes the cyber threats of every organization and set the permission to view the security situation by using access control for every organization. The DSOC has been applied to institute of high energy physics (IHEP) and deployed in several collaborative large scientific facilities and scientific data centers since 2021. The security protections are persistently provided to all organizations within the DSOC framework.