A high-level domain-specific language for SIEM (design, development and formal verification)

Nazir, Abdul; Alam, Masoom; Malik, Saif Ur Rehman; Akhunzada, Adnan; Cheema, Muhammad Nadeem; Khan, Muhammad Khurram; Ziang, Yang; Khan, Tanveer Ahmed; Khan, Abid

doi:10.1007/s10586-017-0819-2

Cited by 5 publications

(4 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Here are some recent works on the subject of this paper. Nazir et al (2016) conducted a study aimed at proposing high-level language for managing information and security events [11]. In the paper, a Data Specification Language is introduced that simplifies the generation of law for information management systems and security events.…”

Section: -Related Workmentioning

confidence: 99%

“…In the paper, a Data Specification Language is introduced that simplifies the generation of law for information management systems and security events. Di Sarno et al (2016) studied the information management systems and security events that solve disparities in security policies [12] and discover the unauthorized network data paths and appropriate configurations for network tools. Granadillo et al (2016) proposed two new approaches to correlation alert [13]; the previous depends on strategy requirement and safeguard ability models, and the last depends on data security markers.…”

Section: -Related Workmentioning

confidence: 99%

“…and security events where differences in security policies are resolved An epic security data and occasion the board framework for improving online protection in a hydroelectric dam Di Sarno et al [12] PIP and PDP are access control blocks and in this paper, the exact relationship of access control with proposed SIEM is not specified.…”

Section: Explaining Information Management Systemsmentioning

confidence: 99%

See 2 more Smart Citations

Secured Access Control in Security Information and Event Management Systems

Rikhtechi¹,

Rafeh²,

Rezakhani³

2021

JIST

View full text Add to dashboard Cite

Section: -Related Workmentioning

confidence: 99%

Section: -Related Workmentioning

confidence: 99%

Section: Explaining Information Management Systemsmentioning

confidence: 99%

See 1 more Smart Citation

Secured Access Control in Security Information and Event Management Systems

Rikhtechi¹,

Rafeh²,

Rezakhani³

2021

JIST

View full text Add to dashboard Cite

“…Although SIEM (security information and event management) systems and IDS/AIR systems are technologies which not cover exactly the same aspects in the security field, their goals, functionalities, and processes are highly related. In fact, it is very common to use high-level languages for the definition of correlation rules in SIEM systems [ 24 ]. For instance in commercial SIEM solutions such as OSSEC (open source HIDS (Host-based Intrussion Detection Systems) SECurity) or OSSIM (open source security information management), an XML-based language is included for that task [ 25 ].…”

Section: Related Workmentioning

confidence: 99%

Automatic Translation and Enforcement of Cybersecurity Policies Using A High-Level Definition Language

Rivera

Monje

Villagrá

et al. 2019

Entropy

View full text Add to dashboard Cite

The increasing number of cyber-attacks, their potential destructive capabilities, and the enormous threat they pose for organizations, require the constant design and development of new, faster, and easier to use systems to address them. The automation of security enforcement systems is one of the most important techniques for enabling a fast response to security challenges, but the complexity of security management might hinder the successful achievement of the desired security. Our proposal integrates the automatic enforcement of security rules based on intrusion detection systems with the definition of a high-level user-centered language for the definition of policies. We have designed a translation process from this language to specific network-wise and device-aware rules that can be installed and enforced. The deployment of these rules is determined by an automatic risk assessment process ruled by the detection system monitoring the network. This way, both the automation and easiness of use goals can be achieved using an integrated system. The solution was tested and validated in two different virtualized networks.

show abstract