scholarly journals An Analysis of Security Event Correlation Techniques in SIEM-Systems. Part 2

2016 ◽  
Vol 6 (49) ◽  
pp. 208 ◽  
Author(s):  
Andrey Vladimirovich Fedorchenko ◽  
Dmitry Sergeevich Levshun ◽  
Andrey Alexeevich Chechulin ◽  
Igor Vitalievich Kotenko
Keyword(s):  
Event Correlation ◽  
Security Event ◽  
Correlation Techniques

A Survey of Security Event Correlation Techniques for Cloud Computing Environment Securit

2017 ◽  
Vol 5 (90) ◽  
pp. 95-104 ◽  
Author(s):  
E. S. Novikova ◽  
◽  
Ya. A. Bekeneva ◽  
A. V. Shorov ◽  
E. S. Fedotov ◽  
...  
Keyword(s):  
Cloud Computing ◽  
Event Correlation ◽  
Computing Environment ◽  
Cloud Computing Environment ◽  
Security Event ◽  
Correlation Techniques

scholarly journals An Analysis of Security Event Correlation Techniques in Siem-Systems. Part 1

2016 ◽  
Vol 4 (47) ◽  
pp. 5 ◽  
Author(s):  
Andrey Vladimirovich Fedorchenko ◽  
Dmitry Sergeevich Levshun ◽  
Andrey Alexeevich Chechulin ◽  
Igor Vitalievich Kotenko
Keyword(s):  
Event Correlation ◽  
Security Event ◽  
Correlation Techniques

Design and Analysis of a Dynamically Configured Log-based Distributed Security Event Detection Methodology

2011 ◽  
Vol 9 (3) ◽  
pp. 219-241 ◽  
Author(s):  
Michael R Grimaila ◽  
Justin Myers ◽  
Robert F Mills ◽  
Gilbert Peterson
Keyword(s):  
Event Correlation ◽  
Bandwidth Utilization ◽  
Detection Capability ◽  
Database Query ◽  
Network Bandwidth ◽  
Distributed Security ◽  
Security Event ◽  
Correlation System ◽  
Proven Method ◽  
Cyber Infrastructure

Military and defense organizations rely upon the security of data stored in, and communicated through, their cyber infrastructure to fulfill their mission objectives. It is essential to identify threats to the cyber infrastructure in a timely manner, so that mission risks can be recognized and mitigated. Centralized event logging and correlation is a proven method for identifying threats to cyber resources. However, centralized event logging is inflexible and does not scale well, because it consumes excessive network bandwidth and imposes significant storage and processing requirements on the central event log server. In this paper, we present a flexible, distributed event correlation system designed to overcome these limitations by distributing the event correlation workload across the network of event-producing systems. To demonstrate the utility of the methodology, we model and simulate centralized, decentralized, and hybrid log analysis environments over three accountability levels and compare their performance in terms of detection capability, network bandwidth utilization, database query efficiency, and configurability. The results show that when compared to centralized event correlation, dynamically configured distributed event correlation provides increased flexibility, a significant reduction in network traffic in low and medium accountability environments, and a decrease in database query execution time in the high-accountability case.

Sign in / Sign up

Export Citation Format

Share Document