Log-Based Distributed Security Event Detection Using Simple Event Correlator

Myers, Justin; Grimaila, Michael R.; Mills, Robert F.

doi:10.1109/hicss.2011.288

Cited by 10 publications

(8 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Cybersecurity attacks are often characterized by unstructured indicators or footprints. Machine learning techniques are proposed [9,10] to automate the detection process. Some indicators have characteristics that lend them to this types of analysis.…”

Section: A Analytics and Visualizationmentioning

confidence: 99%

Survey of data intensive computing technologies application to to security log data management

Tall

Wang

Han

2016

Proceedings of the 3rd IEEE/ACM International Conference on Big Data Computing, Applications and Technologies

View full text Add to dashboard Cite

Data intensive computing research and technology developments offer the potential of providing significant improvements in several security log management challenges. Approaches to address the complexity, timeliness, expense, diversity, and noise issues have been identified. These improvements are motivated by the increasingly important role of analytics. Machine learning and expert systems that incorporate attack patterns are providing greater detection insights. Finding actionable indicators requires the analysis to combine security event log data with other network data such and access control lists, making the big-data problem even bigger. Automation of threat intelligence is recognized as not complete with limited adoption of standards. With limited progress in anomaly signature detection, movement towards using expert systems has been identified as the path forward. Techniques focus on matching behaviors of attackers to patterns of abnormal activity in the network. The need to stream, parse, and analyze large volumes of small, semistructured data files can be feasibly addressed through a variety of techniques identified by researchers. This report highlights research in key areas, including protection of the data, performance of the systems and network bandwidth utilization.

show abstract

Section: A Analytics and Visualizationmentioning

confidence: 99%

Survey of data intensive computing technologies application to to security log data management

Tall

Wang

Han

2016

Proceedings of the 3rd IEEE/ACM International Conference on Big Data Computing, Applications and Technologies

View full text Add to dashboard Cite

show abstract

“…The NIST [9] outlines the principles underlining the computer log event management and event correlation to detect anomalous activities on a system. The intelligence includes network packet signatures, intrusion detection signatures, log correlation sequences, firewall pre-sets (network port configurations), and many more [2,4,7,14,15]. Liao et al [8] discuss how the latest technologies are evolving in adapting to such attacks.…”

Section: A the Emergence Of The Breach-point Detection Problemmentioning

confidence: 99%

“…They provide a taxonomy to modern IDS designs and the methods adopted for detection. Myers et al [15] present a distributed event correlation system, which performs security event detection, with experimental evaluation, taking into account network bandwidth utilization, detection capability and query efficiency, in comparison with a centralized alternative. They conclude that distributed processing environment can provide up to 99% reduction of network syslog traffic allowing for near real-time detection.…”

Section: Related Workmentioning

confidence: 99%

Estimating Posterior Probabilities to Identify Breach Points during Cyber-attacks

Raghavan¹

2015

2015 Fourth International Conference on Cyber Security, Cyber Warfare, and Digital Forensic (CyberSec)

View full text Add to dashboard Cite

When a security incident is reported, identifying the point-of-breach is critical to figure out what an attacker might do next. Besides, the information related to the resources and levels of privilege acquired as a result of the breach, is essential to recreate the process. Such information is also crucial to planning a defense in real-time. To this end, we need to determine the following parameters associated with the system under attack, viz., a breach probability determined from the success of past cyber-attacks, the attack matrix which is dependent on the system design that decides the types of attacks and the associated modalities that the system may be susceptible to under standard conditions, and the access matrix which is determined by the access privileges that get granted when an attack succeeds.In this paper, we introduce the breach-point detection problem and present a model based on Bayes' conditional probability to identify the point-of-breach on a system impacted by a cyberattack. We evaluate the probability associated with likely pointsof-breach in the rest of the system based on the knowledge of its design and estimate the posterior probabilities associated with the points so identified based on the system parameters outlined earlier. We also determine the most probable point-of-breach and its posterior probability using our model. We demonstrate the use of our model by way of a numerical example. Finally, we illustrate the generalization of this approach to an arbitrary system and outline a method to compute its system parameters, viz., the breach probability, the attack matrix and the access matrix.Index Terms-Attack matrix, Access matrix, Breach probability, Bayes posterior probability, point-of-breach, Breach-point detection problem.

show abstract

“…According to Myers et al [80], event correlation is frequently not performed with log analysis due to "difficulties and inadequacies with current technologies". One reason they indicate that organizations have difficulties analyzing security logs is because of "the sheer volume of data to collect, process and store".…”

Section: Big Heterogeneous Cyberspace Datamentioning

confidence: 99%

Intrusion detection and Big Heterogeneous Data: a Survey

Zuech

Khoshgoftaar

Wald

2015

Journal of Big Data

241

100

View full text Add to dashboard Cite

Intrusion Detection has been heavily studied in both industry and academia, but cybersecurity analysts still desire much more alert accuracy and overall threat analysis in order to secure their systems within cyberspace. Improvements to Intrusion Detection could be achieved by embracing a more comprehensive approach in monitoring security events from many different heterogeneous sources. Correlating security events from heterogeneous sources can grant a more holistic view and greater situational awareness of cyber threats. One problem with this approach is that currently, even a single event source (e.g., network traffic) can experience Big Data challenges when considered alone. Attempts to use more heterogeneous data sources pose an even greater Big Data challenge. Big Data technologies for Intrusion Detection can help solve these Big Heterogeneous Data challenges. In this paper, we review the scope of works considering the problem of heterogeneous data and in particular Big Heterogeneous Data. We discuss the specific issues of Data Fusion, Heterogeneous Intrusion Detection Architectures, and Security Information and Event Management (SIEM) systems, as well as presenting areas where more research opportunities exist. Overall, both cyber threat analysis and cyber intelligence could be enhanced by correlating security events across many diverse heterogeneous sources.

show abstract

Log-Based Distributed Security Event Detection Using Simple Event Correlator

Cited by 10 publications

References 5 publications

Survey of data intensive computing technologies application to to security log data management

Survey of data intensive computing technologies application to to security log data management

Estimating Posterior Probabilities to Identify Breach Points during Cyber-attacks

Intrusion detection and Big Heterogeneous Data: a Survey

Contact Info

Product

Resources

About