MODEL OF CYBER INCIDENT IDENTIFICATION BY SIEM FOR PROTECTION OF INFORMATION AND COMMUNICATION SYSTEMS
DOI:
https://doi.org/10.28925/2663-4023.2023.20.8192Keywords:
information and communication system; cyber defense; cyber incident; SIEM; multi-parameter identification; fuzzy set theory; knowledge baseAbstract
The article presents a model for identifying cyber incidents by a SIEM system that occur in the course of operation of information and communication systems (ICS). A list of tasks performed by the SIEM system in the ICS protection circuit and the mechanisms that form its basis, which, in turn, are components of the general process of correlation of events occurring in the ICS, is given. The methods of the correlation process aimed at removing, combining and linking data on events in the ICS with the establishment of its causality and priority are analyzed. It is concluded that the existing methods are ineffective in the context of incomplete and inaccurate information about cyber incidents. The tuple model for recognizing cyber incidents is analyzed and an improved model based on the theory of fuzzy sets and linguistic terms is proposed to eliminate its shortcomings. A new formulation of the problem of recognizing cyber incidents is proposed, which is reduced to their identification. The methods for solving it are analyzed and a number of their significant shortcomings are identified, which make it difficult to use them in practice. An approach to solving the formulated problem of identifying cyber incidents by a SIEM system is proposed on the basis of forming a fuzzy knowledge base of the SIEM system about their features based on the collection of expert information and its further processing by applying the theory of fuzzy sets. The basic principles that should be used when developing a mathematical model for identifying cyber incidents by a SIEM system are formulated. A model of a fuzzy knowledge base of cyber incidents is proposed in the form of a multidimensional table with the features of cyber incidents represented by linguistic terms and classes that correspond to them. A representation of the fuzzy knowledge base (matrix) in the form of a system of fuzzy rules of the "IF-THEN" type is presented, and on their basis, by applying the min and max operations, a model for identifying cyber incidents by a SIEM system is proposed. It is concluded that it is expedient to use the model presented in the paper to protect information and communication systems in the conditions of incomplete and inaccurate information about cyber incidents arising in the course of their operation.
Downloads
References
Herasymov, B.M., Subach, I.Iu., Khusainov, P.V., Mishchenko, V.O. (2008) Analiz zadach monitorynhu informatsiinykh merezh ta metodiv pidvyshchennia efektyvnosti yikh funktsionuvannia. Suchasni informatsiini tekhnolohii u sferi bezpeky ta oborony, 3(3), 24−27.
Subach, I., Kubrak, V., Mykytiuk, A. (2019) Arkhitektura ta funktsionalna model perspektyvnoi proaktyvnoi intelektualnoi systemy SIEM-systemy dlia kberzakhystu obiektiv krytychnoi infrastruktury. Information Technology and Security, 7(2), 208-215. https://doi.org/10.20535/2411-1031.2019.7.2.190570.
Samokhvalov, Yu., Toliupa, C. (2017). Koreliatsyia sobыtyi v SIEM-systemakh na osnove nemonotonnoho vыvoda. Zakhyst informatsii, 19(1), 5-9.
Jakobson, G., Weissman M. (1993). Alarm correlation. IEEE Network, 7(6), 52 59.
Tiffany, M. (2002). A survey of event correlation techniques and related topics. http://www.tiffman.com/netman/netman.html.
Sadoddin, R., Ghorbani, A. (2006). Alert Correlation Survey: Framework and Techniques, In Proceedings of International Conference on Privacy, Security and Trust: Bridge the Gap Between PST Technologies and Business Services (PST`06), October, 2006. Article no. 37. (pp. 1–10).
Borkar, P. (2018). SIEM Rules or Models for Threat Detection? Exabeam. https://www.exabeam.com/siem/siem-threat-detection-rules-or-models/.
Salo, F., Injadat, M., Nassif, A., Shami, A., Essex, (2018). A Data Mining Techniques in Intrusion Detection Systems: A Systematic Literature Review, In Proc. IEEEAccess, September 2018, 6,(pp. 56046–56058).
Muller, A. (2009). Event Correlation Engine. Master`s Thesis. Swiss Federal Institute of Technology Zurich.
Hanemann, A., Marcu, P. (2008). Algorithm Design and Application of ServiceOriented Event Correlation, In Proceedings of Conference BDIM 2008, 3rd IEEE/IFIP International Workshop on Business-Driven IT Management. (pp. 61–70).
Elshoush, H., Osman, I.M. (2011). Alert correlation in collaborative intelligent intrusion detection systems. A survey. Applied Soft Computing, 4349–4365.
Zadeh, L. (1976). The concept of a linguistic variable and its application to approximate decision making. Mir.
Rothstein, A.P. (1996). Medical Diagnostics on Fuzzy Logic. Continent-PRIM.
Rothstein, A.P. (1999). Intelligent Identification Technologies: Fuzzy Sets, Genetic Algorithms, Neural Networks. UNIVERSUM.
Zaichenko, Y.P. (1991). Operations Research: Fuzzy Optimisation. Vyshcha Shkola.
Borisov, A.N., Krumberg, O.A., Fedorov, I.P. (1990). Decision-Making on the Basis of Fuzzy Models: Examples of Use. Zinatne.
Fesokha, V., Subach, I., Kubrak, V., Mykytiuk, A., Korotaiev, S. (2020). Zero-day polymorphic cyberattacks detection using fuzzy inference system. Austrian Journal of Technical and Natural Sciences, 5-6, 8-13. https://doi.org/10.29013/AJT-20-5.6-8-13.
Subach, I, Zdorenko, Yu., Fesokha, V. (2018). Metodyka vyiavlennia kiberatak typu JS(HTML)/Scrinject na osnovi zastosuvannia matematychnoho aparatu teorii nechitkykh mnozhyn. Zbirnyk naukovykh prats Viiskovoho instytutu telekomunikatsii ta informatyzatsii imeni Heroiv Krut, 4, 125–131.
Herasymov, B, Subach, I., Nikiforov, Ye. (2005). Modeli nadannia znan dlia vykorystannia v systemakh pidtrymky pryiniattia rishen. Naukovo-tekhnichna informatsiia, 1, 7 – 11.
Kalnish, V. (2019). Monitoring psychophysiological functions of operators in the process of their work activity. Ukrainian journal of occupational healt, 15(3), 204-215. https://doi.org/10.33573/ujoh2019.03.204.
Subach, I., Herasymov, B. (2008). Pokaznyky yakosti informatsiinoho zabezpechennia ta yikh vplyv na efektyvnist zastosuvannia ISPPR. Visnyk Natsionalnoho universytetu im. Tarasa Shevchenka, 20, 27–29.
Published
How to Cite
Issue
Section
License
Copyright (c) 2023 Ігор Субач, Володимир Кубрак
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
