Dynamic security management driven by situations: An exploratory analysis of logs for the identification of security situations

Abstract

Situation awareness consists of "the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future". Being aware of the security situation is then mandatory to launch proper security reactions in response to cybersecurity attacks. Security Incident and Event Management solutions are deployed within Security Operation Centers. Some vendors propose machine learning based approaches to detect intrusions by analysing networks behaviours. But cyberattacks like Wannacry and NotPetya, which shut down hundreds of thousands of computers, demonstrated that networks monitoring and surveillance solutions remain insufficient. Detecting these complex attacks (a.k.a. Advanced Persistent Threats) requires security administrators to retain a large number of logs just in case problems are detected and involve the investigation of past security events. This approach generates massive data that have to be analysed at the right time in order to detect any accidental or caused incident. In the same time, security administrators are not yet seasoned to such a task and lack the desired skills in data science. As a consequence, a large amount of data is available and still remains unexplored which leaves number of indicators of compromise under the radar. Building on the concept of situation awareness, we developed a situation-driven framework, called dynSMAUG, for dynamic security management. This approach simplifies the security management of dynamic systems and allows the specification of security policies at a high-level of abstraction (close to security requirements). This invited paper aims at exposing real security situations elicitation, coming from networks security experts, and showing the results of exploratory analysis techniques using complex event processing techniques to identify and extract security situations from a large volume of logs. The results contributed to the extension of the dynSMAUG solution.

An Adaptive, Situation-Based Risk Assessment and Security Enforcement Framework for the Maritime Sector

“…A situation is a particular time frame of interest with a beginning, a life span and an end [ 34 ]. The beginning and the end of a situation can determined by combining multiple events coming from multiple sensors and occurring at different moments [ 9 ]. Indeed the beginning and the end of a situation involving multiple entities and multiple conditions cannot be limited to simple events captured by one single sensor.…”

“…The specification of the situations depends on the sensors available in the vessel and their characteristics. Different patterns for describing situations using CEP have been proposed in [ 8 , 9 ]. The resulting low level situations specification is then provided to a situation manager that continuously calculate the current situation.…”

“…In this paper, we propose an adaptive security framework that covers both dynamic risk assessment and situational driven security policy deployment. We extend a maritime-specific risk assessment methodology (MITIGATE [ 5 , 6 ]) to suggest adaptive security controls, and integrate it with a situation-driven security management framework (DynSMAUG [ 7 , 8 , 9 ]) to dynamically enforce adaptive security policies implementing the security controls. We will follow a situation-driven approach.…”

Interpretable Feature Learning in Multivariate Big Data Analysis for Network Monitoring

“…Due to the increasing complexity of networks and the growing trend in network traffic, network monitoring has become increasingly challenging [15]. The literature is rich in data sources and methods for monitoring [16], [17], [18]. Fuentes-García et al [19] discuss the framework of data integrators in network security monitoring, with the notable example of Security Information and Event Management (SIEM) Systems.…”