MODEL OF CYBER INCIDENT IDENTIFICATION BY SIEM FOR PROTECTION OF INFORMATION AND COMMUNICATION SYSTEMS

Abstract

The article presents a model for identifying cyber incidents by a SIEM system that occur in the course of operation of information and communication systems (ICS). A list of tasks performed by the SIEM system in the ICS protection circuit and the mechanisms that form its basis, which, in turn, are components of the general process of correlation of events occurring in the ICS, is given. The methods of the correlation process aimed at removing, combining and linking data on events in the ICS with the establishment of its causality and priority are analyzed. It is concluded that the existing methods are ineffective in the context of incomplete and inaccurate information about cyber incidents. The tuple model for recognizing cyber incidents is analyzed and an improved model based on the theory of fuzzy sets and linguistic terms is proposed to eliminate its shortcomings. A new formulation of the problem of recognizing cyber incidents is proposed, which is reduced to their identification. The methods for solving it are analyzed and a number of their significant shortcomings are identified, which make it difficult to use them in practice. An approach to solving the formulated problem of identifying cyber incidents by a SIEM system is proposed on the basis of forming a fuzzy knowledge base of the SIEM system about their features based on the collection of expert information and its further processing by applying the theory of fuzzy sets. The basic principles that should be used when developing a mathematical model for identifying cyber incidents by a SIEM system are formulated. A model of a fuzzy knowledge base of cyber incidents is proposed in the form of a multidimensional table with the features of cyber incidents represented by linguistic terms and classes that correspond to them. A representation of the fuzzy knowledge base (matrix) in the form of a system of fuzzy rules of the "IF-THEN" type is presented, and on their basis, by applying the min and max operations, a model for identifying cyber incidents by a SIEM system is proposed. It is concluded that it is expedient to use the model presented in the paper to protect information and communication systems in the conditions of incomplete and inaccurate information about cyber incidents arising in the course of their operation.