A survey on artificial intelligence techniques for security event correlation: models, challenges, and opportunities

Abstract

Information systems need to process a large amount of event monitoring data. The process of finding the relationships between events is called correlation, which creates a context between independent events and previously collected information in real time and normalizes it for subsequent processing. In cybersecurity, events can determine the steps of attackers and can be analyzed as part of a specific attack strategy. In this survey, we present the systematization of security event correlation models in terms of their representation in AI-based monitoring systems as: rule-based, semantic, graphical and machine learning based-models. We define the main directions of current research in the field of AI-based security event correlation and the methods used for the correlation of both single events and their sequences in attack scenarios. We also describe the prospects for the development of hybrid correlation models. In conclusion, we identify the existing problems in the field and possible ways to overcome them.

A novel approach for APT attack detection based on feature intelligent extraction and representation learning

“…Currently, the studies on APT attack detection are relatively developed and have many different approaches [4][5][6][7]. However, the most popular and effective approach is still to combine techniques analyzing abnormal behaviors on network traffic datasets, and machine learning or deep learning algorithms [8][9][10][11]. According to the Network Traffic-based APT attack detection approach, previous studies often focused on two main solutions: i) Analyzing Network Traffic into different components such as DNS log [12,13], HTTP log [14], TLS log, etc., and then trying to detect abnormal behaviors of APT attack on each of these components [5,6], or building the behavior profile of each APT IP based on the correlation between the above components [15][16][17][18][19][20][21][22]; ii) Analyzing Network Traffic into flow or NetFlow and then extracting abnormal behaviors of APT attack.…”

A Critical Historic Overview of Artificial Intelligence: Issues, Challenges, Opportunities, and Threats

“…The growth of AI has been impressive. Attempts to advance AI technologies over the past 50-65 years have emerged in several incredible innovations and developments (Arbib, 2002;Baldi, 2021;Cybenko, 1989;Deng et al, 2013;Dignum, 2019;Frey et al, 1995;Fukushima, 1980;Groumpos, 2016;Hawkins, 2019;Heykin, 2009;Hubel & Wiesel, 1959;Ivakhnenko, 1971;Levshun & Kotenko, 2023;Mendez et al, 2022;O'Reilly et al, 2021;Schmidhuber, 2015;McCulloch & Pitts, 1943;Roberts et al, 2022;Schmidhuber & Prelinger, 1993;Russel & Norvig, 2020;Shrager & Johnson, 1995). To comprehend better the several challenging issues of AI, we need to understand well the four basic AI concepts: (1) ML, (2) NNs, (3) DL, and (4) EI as follows.…”

“…Other related technologies such as ML, NNs, DL, EI, and big data-driven algorithms are following suit. These technologies have numerous widely beneficial applications (Arbib, 2002;Baldi, 2021;Ball et al, 2017;Bengio, 2009;Bierly et al, 2000;Cybenko, 1989;Deng et al, 2013;Dignum, 2019;Frey et al, 1995;Fukushima, 1980;Groumpos, 2016;Hawkins, 2019;Heykin, 2009;Hochreiter & Schmidhuber, 1997;Hubel & Wiesel, 1959;Ivakhnenko, 1971;Levshun & Kotenko, 2023;Marcus, 2012;Marwala, 2015;McCulloch & Pitts, 1943;Mendez et al, 2022;Murphy, 2012;O'Reilly et al, 2021;Roberts et al, 2022;Russel & Norvig, 2020;Schmidhuber & Prelinger, 1993;Schmidhuber, 2015;Shrager & Johnson, 1995;Utgoff & Stracuzzi, 2002;Weng et al, 1992;Weng et al, 1997). Historically, less attention has been paid to the malicious uses of AI, which poses a challenge to the AI community.…”

“…deep neural networks (DNNs) (3) convolutional deep neural networks (CDNNs) (4) Deep belief network (DBNs) (5) Recurrent neural networks (RNNs) and (6) long short-term memory (LSTM) More details and full analysis of the six and other DL methods can be found inPhilbeck & Davis (2018);Hinton (2009);Deng & Yu (2014);Hochreiter & Schmidhuber (1997);Murphy (2012);Utgoff & Stracuzzi (2002);Weng et al (1997);Weng et al (1992);Bengio (2009);Bierly et al (2000); Marwala (2015);Levshun & Kotenko (2023);Arbib (2002);Heykin (2009);Roberts et al (2022); Baldi (2021); Russel & Norvig (2020); Dignum (2019); O'Reilly et al (2021); and Ball et al (2017). However, studying them carefully, all are revised old methods of AI including ML and NN!…”

Soft computing algorithms for infrastructure monitoring: preliminary results of PROION project

“…To build intelligent machines more efficiently we should use ourselves as blueprint. Over the last 50-55 years several AI amazing innovations have been developed and significant scientific results [17][18][19][20][21][22].…”