Uma Plataforma para Correlação, Visualização e Extração de Tendências de Dados de Segurança

Abstract

Digital data production increases on a daily basis due to the widespreaduse of Internet and interconnected computing devices. Actingsecurity mechanisms may result in several types of information,if processed and correlated, since their output logs range from IPaddresses/regions to attack events. Hence, the application of datascience techniques is essential to extract knowledge and insightsfrom this massive amount of data. In this article, we present a platformfor cybersecurity data visualization in an effort to identifytrends, associations and patterns, which enable better data-drivendecisions. To prototype and test the proposed platform, we focusedon endpoint logs provided from a cybersecurity company. Theconclusions drawn from this study are that there is a substantialconcentration of victims in urbanized areas, notably the state capitals,as well as a higher risk level for Server Operating Systems.Nevertheless, these results are still preliminary, considering thelimitations of the dataset (few, specific samples from internal testingendpoints), but helped pave the way towards new models forfurther threat analysis.