Near-miss situation based visual analysis of SIEM rules for real time network security monitoring

Majeed, Abdul; Rasool, Raihan Ur; Ahmad, Farooq; Alam, Masoom; Javaid, Nadeem

doi:10.1007/s12652-018-0936-7

Cited by 18 publications

(8 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The work in [3] extended the manual process to develop an embedded analytics tool that examines an entire log file and provides tools to find novelty, anomalies, and contextual meaning in a log. Notably, the authors in [31] recently proposed a similar process to that of [3]. Herein, we extend upon [3] with more advanced analytics as well as a feedback approach.…”

Section: Big Cyber Log Datamentioning

confidence: 96%

Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics

Bihl

Gutierrez

Bauer

et al. 2020

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

Forensic analysis of logs is one responsibility of an enterprise cyber defense team; inherently, this is a big data task with thousands of events possibly logged in minutes of activity. Logged events range from authorized users typing incorrect passwords to malignant threats. Log analysis is necessary to understand current threats, be proactive against emerging threats, and develop new firewall rules. This paper describes embedded analytics for log analysis, which incorporates five mechanisms: numerical, similarity, graph-based, graphical analysis, and interactive feedback. Topological Data Analysis (TDA) is introduced for log analysis with TDA providing novel graph-based similarity understanding of threats which additionally enables a feedback mechanism to further analyze log files. Using real-world firewall log data from an enterprise-level organization, our end-to-end evaluation shows the effective detection and interpretation of log anomalies via the proposed process, many of which would have otherwise been missed by traditional means.

show abstract

Section: Big Cyber Log Datamentioning

confidence: 96%

Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics

Bihl

Gutierrez

Bauer

et al. 2020

Proceedings of the Annual Hawaii International Conference on System Sciences

View full text Add to dashboard Cite

show abstract

“…This allows administrators to see anomalies like login attempts from suspicious locations, network scans, and simultaneous user authentication attempts from various locations. The SIEM also monitors network traffic using this rule for better detection of threats and unusual activity [11]. It also can automatically extract this important information into a report or diagram that allows us to visualize activities from many sources.…”

Section: Event Correlationmentioning

confidence: 99%

“…The paper examined the most frequent AETs as well as the tools used to carry out such attacks. An Adaptive learning system based on an Artificial Immune System (AIS) has been proposed by A. Majeed et al [11]. The authors use the near-miss situation based on visual analysis for the SIEM rules.…”

Section: Current Research On Siemmentioning

confidence: 99%

See 1 more Smart Citation

SIEM Network Behaviour Monitoring Framework using Deep Learning Approach for Campus Network Infrastructure

Isa

Khairuddin

Sulaiman

et al. 2021

Int. j. electr. comput. eng. syst. (Online)

View full text Add to dashboard Cite

One major problem faced by network users is an attack on the security of the network especially if the network is vulnerable due to poor security policies. Network security is largely an exercise to protect not only the network itself but most importantly, the data. This exercise involves hardware and software technology. Secure and effective access management falls under the purview of network security. It focuses on threats both internally and externally, intending to protect and stop the threats from entering or spreading into the network. A specialized collection of physical devices, such as routers, firewalls, and anti-malware tools, is required to address and ensure a secure network. Almost all agencies and businesses employ highly qualified information security analysts to execute security policies and validate the policies’ effectiveness on regular basis. This research paper presents a significant and flexible way of providing centralized log analysis between network devices. Moreover, this paper proposes a novel method for compiling and displaying all potential threats and alert information in a single dashboard using a deep learning approach for campus network infrastructure.

show abstract

“…In addition, we can use graphs to perform real-time threat analysis. This can enable security analysts to deploy defense mechanism accordingly [66]. We can also present the failure attempts on a particular system via graphs.…”

Section: Uses Of Graph Algorithms/concepts In Network Security Monitomentioning

confidence: 99%

Graph Theory: A Comprehensive Survey about Graph Theory Applications in Computer Science and Social Networks

Majeed

Rauf

2020

Inventions

Self Cite

View full text Add to dashboard Cite

Graph theory (GT) concepts are potentially applicable in the field of computer science (CS) for many purposes. The unique applications of GT in the CS field such as clustering of web documents, cryptography, and analyzing an algorithm’s execution, among others, are promising applications. Furthermore, GT concepts can be employed to electronic circuit simplifications and analysis. Recently, graphs have been extensively used in social networks (SNs) for many purposes related to modelling and analysis of the SN structures, SN operation modelling, SN user analysis, and many other related aspects. Considering the widespread applications of GT in SNs, this article comprehensively summarizes GT use in the SNs. The goal of this survey paper is twofold. First, we briefly discuss the potential applications of GT in the CS field along with practical examples. Second, we explain the GT uses in the SNs with sufficient concepts and examples to demonstrate the significance of graphs in SN modeling and analysis.

show abstract

Near-miss situation based visual analysis of SIEM rules for real time network security monitoring

Cited by 18 publications

References 49 publications

Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics

Topological Data Analysis for Enhancing Embedded Analytics for Enterprise Cyber Log Analysis and Forensics

SIEM Network Behaviour Monitoring Framework using Deep Learning Approach for Campus Network Infrastructure

Graph Theory: A Comprehensive Survey about Graph Theory Applications in Computer Science and Social Networks

Contact Info

Product

Resources

About