A Variant of the Analytical Specification of Security Information and Event Management Systems

Abstract

The object of the study in the chapter is a variant of the analytical specification of the state change dynamics characterizing the quality indicators of the process fulfilled by a security information and event management (SIEM) system. A generalized model of such a system based on the state and observation equations taking into account advanced algorithms for converting excitation noise (spectral power density of excitation noise) is investigated. Moreover, the model is a formalized analytical description specified in terms of the Markov chain in the form of different stochastic equations. The dynamics of changes in the values of quality indicators characterizing the essential properties of the SIEM system functioning in the state space are analyzed. A mechanism for determining the values of the mathematical expectation increment of the simulated process is proposed. These values are obtained on the basis of a priori data on the Markov chain with respect to the mathematical expectation of white Gaussian noise exciting this process. The specified mechanism is used in conjunction with the calculation of the values of the coefficient that corrects the variance of random discrete realizations of the original white Gaussian noise. This approach allows one to make a decision about what values the elements of the vector of compensation additives will take in the state equation of this modified model of the SIEM system taking into account the excitation noise conversion.