Event Management System Research Articles

Object Oriented Modeling of Secured Paid Virtual Event Management System

Object Oriented Modeling of Secured Paid Virtual Event Management System

TECHNOLOGIES OF USER ACTIVITIES MONITORING AND ANALYSIS IN PREVENTING INSIDER THREATS OF INFORMATION SECURITY OF AN ORGANIZATION

The increase in the number of information security incidents related to personnel activities, the frequency of which has almost doubled in the last two years, has led organizations to use effective technologies that prevent and counteract internal threats to information security. An important role in this context belongs to the tools of monitoring and analysis of user activity. According to experts, in the coming years, such technologies will be implemented in 80% of solutions to identify threats and prioritize information security incidents. The article reveals the essence and analyzes the functionality of several systems that monitor and analyze employee behavior, including Data Loss Prevention (DLP), Access Control, Analysis of User Behavior and IT objects (UBA / UEBA). The authors establish that the DLP system monitors and reports on user attempts to transmit confidential information by monitoring mail and web traffic, wireless access, external storage, input/output devices, user workstation software, audio and video surveillance of its activities, etc. Access control tools perform, in particular, the functions of monitoring access and movement of a person in protected areas of the object, collecting information from surveillance cameras, keeping records of working time. In the context of a pandemic, solutions have been developed that allow identifying a person in a mask on the face, to perform the functions of monitoring health. Analysis of the functional characteristics of UBA / UEBA behavioral analytics systems showed that they not only solve the problem of collecting data from all possible available sources (software and hardware, logs, user correspondence, etc.), but also analyze the collected data and report atypical user behavior in case of its detection. The article notes that behavioral analytics is used in a number of security technologies, such as Security Information and Event Management system, Intrusion Detection and Prevention System, and others, complementing and expanding their capabilities, helping to create comprehensive information security solutions. The authors recommend organizations to use tools for monitoring and analyzing the user activities in different combinations or as part of integrated Information Security Management solutions to achieve the appropriate information security level in the face of growing threats from personnel.

Partial rule security information and event management concept in detecting cyber incidents

Information communication technologies are evolving rapidly and have huge impact on everyday life. This does not come without dangers, i.e., it is actively followed by wide range of malicious activities that impact the companies forcing them to protect their information at all costs. Cyber attacks today are usually consisting of multiple carefully planned hardly detectable steps causing severe damage to companies. This paper examines the capability of security information and event management (SIEM) system with applied partial rules in detecting the multi-step attacks. Fine tuning was focused on detecting partial attack patterns that were important and specific to environment and positive results were gained. The results show that when using the partial rule approach in SIEM for incident detection, the number of detected advanced multistage cyber attacks has increased, thereby contributing to the overall security in cyber space.

IoT Based Event Management System Using RFID

This paper introduces the implementation of IoT based event management system using RFID. These days Security has become crucial in sensitive areas like Meetings and many places where VIPs attend, the event managers need to log the entry of the guests to ensure no outsiders except invites are attending the meet. It’s not easy for a person to manually log the entry of attendees with their entry time, and these days due to COVID-19 Pandemic everything is being contactless so it is not even possible to use fingerprint sensor and the fingerprints of the attendees need to be pre-registered, this may be not possible in many cases. In these cases, the IoT- based Event Management System using RFID plays a vital role in logging the entry of the attendees, this requires no human intervention and ensures contactless procedure. The details of the attendees are encoded in the RFID cards and they are given to attendees as the entry pass to the event, at the entrance the attendees need to place the RFID card before the RFID reader, the RFID reader decodes the information in the RFID Card and displays the name and place of the attendees, using NodeMCU the System can be connected to the internet and data can be retrieved from the ThingSpeak Server which is pre-configured by the event organizers, and the entry time of the attendees will be stored internally which can be retrieved from ThingSpeak Server. IoT-based Event Management System not only tracks the entry log but also sends the log and entry data directly to a dedicated server that can handle all of the authentication, authorization, and management. This helps in monitoring the Sensitive areas and to log the entry of invites.

Highly Secure Residents Life Event Management System Based on Blockchain by Hyperledger Fabric

This article describes the design and implementation of Residents Life Event Management System (hereinafter called as RLEMS) with high level reliability and security by blockchain technology. The data access environment provided by blockchain is highly secure and trustworthy. In Blockchain system, some data fragments are grouped into one piece called as blocks, and all blocks are connected to create a chain of blocks in database. When blocks are connected, hash value is used to connect blocks properly. Blockchain technology enables highly secure and reliable data management system under relatively poor ICT environment. For example, developing countries such as African countries do not have sufficient ICT environment. Therefore adopting blockchain technology is suitable for such countries. Based on this consideration, we have started to build RLEMS on the blockchain system. In previous work, we used the MultiChain as a blockchain platform. However, as MultiChain platform is mainly for private blockchain system, it is not suitable for government-level data management system. Therefore, we tried to use another blockchain framework. We selected Hyperledger Fabric which was developed by Linux Foundation. It enables to implement all styles of blockchain system. This article describes the design and implementation of RLEMS by using Hyperledger Fabric. Furthermore, to provide the best user experience, we also built the web application interface with Java web application framework named PrimeFace. The implementation of a prototype revealed that the Hyperledger Fabric blockchain technology is more suitable than MultiChain.

Optimization of Sports Event Management System Based on Wireless Sensor Network

In recent years, wireless sensor network technology has developed rapidly and its role in managing systems for sports events has been widely used. Wireless sensor networks not only have low wiring cost, high monitoring accuracy, and good fault tolerance but also can be monitored remotely and have outstanding advantages in fault diagnosis and safety monitoring. In this paper, firstly, the wireless sensor network hierarchical routing protocol is studied and its network model and workflow are analyzed; according to the energy consumption of the wireless sensor network, the selection method of the optimal number of cluster heads is proposed to analyze the advantages and disadvantages existing in the protocol. Secondly, the improvement of the routing protocol is proposed to address the problems of uneven distribution of cluster heads and cluster head election without considering the residual energy of nodes in the protocol. When dividing clusters, the number of neighboring nodes is considered so that cluster heads are distributed more evenly in the network; when electing cluster heads, the residual energy of nodes in the cluster is considered to balance the whole network load, and when electing cluster heads, the residual energy of nodes in the cluster is considered to balance the whole network load. Finally, simulation experiments are conducted in this paper using simulation software, and the simulation results show that the data fusion algorithm is more effective than the protocol in reducing the average energy consumption of nodes and extending the network lifetime; these features make wireless sensors more beneficial for better management of sporting events as well as better optimization.

Towards GDPR-compliant data processing in modern SIEM systems

The introduction of the General Data Protection Regulation (GDPR) in Europe raises a whole series of issues and implications on the handling of corporate data. We consider the case of security-relevant data analyses in companies, such as those carried out by Security Information and Event Management (SIEM) systems. It is often argued that the processing of personal data is necessary to achieve service quality. However, at present existing systems arguably are in conflict with the GDPR since they often process personal data without taking data protection principles into account. In this work, we first examine the GDPR regarding the resulting requirements for SIEM systems. On this basis, we propose a SIEM architecture that meets the privacy requirements of the GDPR and show the effects of pseudonymization on the detectability of incidents.

Исследование алгоритмов адаптивных нейро-нечетких сетей ANFIS для решения задачи идентификации сетевых атак

At the moment, the pace of change in the nature of cybersecurity incidents necessitates the modification of existing algorithms for identifying attacks in intrusion detection systems in such a way that a quick response to new types of attacks is carried out. Modern algorithms for data mining allow building solutions to such problems, however, the result, as a rule, depends both on the tools and learning algorithms used, and on the quality of the data on which the model is built. To improve the quality of data due to objective uncertainty, there is a complex of methods and algorithms for processing and filtering, while the influence of the subjectivity of experts is the most difficult task, the effectiveness of which was shown by the systems of neuro-fuzzy inference. In this regard, this work is aimed at studying the algorithms of adaptive neuro-fuzzy networks ANFIS based on various representations of fuzzy rules that allow the classification of incoming network traffic to identify various cybersecurity incidents. The obtained results of a general assessment of the effectiveness of identifying network attacks using various measures of accuracy showed that the most optimal neuro-fuzzy classifier is the ANFIS network using fuzzy Takagi-Sugeno-Kanga inference. At the same time, the least effective results of identifying various types of network attacks were shown by the use of Wang-Mendel's fuzzy inference. The developed modules can be used to process data received from sensors of the security information and event management system.

Effectiveness of Security Incident Event Management (SIEM) System for Cyber Security Situation Awareness

Cyber-attacks have always targeted information communication technology systems of various organizations.Intruders and hackers have within their reach, very powerful tools through which they capable to bypassthe existing network security so as to deliver a payload that might have a severe impact on the wholeorganization. Therefore, it has become essential for organizations to develop mechanisms through whichthey can detect a possible cyber threat and then respond accordingly. By establishing cybersecurity situationawareness, organizations will understand what is happening and then respond effectively. The presentstudy evaluated the effectiveness of the Security Incident Event Management (SIEM) system for CyberSecurity Situation Awareness. A Hierarchical Network Security Situation Assessment Model (referred toHNSSAM) which joins Security Incident Event Management (SIEM) system evidence theory fusion ruleswith classified quantitative risk assessment method was applied. Data processing was initially designed soas to collect security data from various sensors. Mechanisms for data verification were then adopted so as toestablish whether SIEM was effective in successfully detecting any form of cyber-attack. Results show thatSIEM tools may be applied by security analysts to gain visibility into the security threats attacking the ITsystems of an organization and then respond appropriately.

Implementation of Information Security System in Service and Trade

Usage of information technologies in service and trade industry is increasing daily which is accompanied by information leakage risks. Information security system can prevent threats from employee’s lack of skills and detect vulnerabilities on early stages. To implement information security system, general steps are to build conceptual model of the subject area, build a semantic network to follow decision making process, adept current situation in company to ISO 27001 requirements and choose information system to atomize business processes. EPC diagram given in this paper shows the steps that service and trade companies can follow to get ISO 27001 certificate. The article describes such security information and event management systems as IBM QRadar security intelligence platform, Splunk Enterprise Security and RSA NetWitness Suite. The results of the research show how implementation of information security policy impact company’s indicators and reputation. Cyber security system’s implementation can lead to low expenses caused by interruption in service or data leakage, increased reliability and security of systems and improved business processes’ optimization.

New approach for threat classification and security risk estimations based on security event management

Security Information and Event Management (SIEM) systems are essential for identifying cyber attacks, being an extended practice in organizations to detect threats, vulnerabilities and to estimate security risks. The management of events and information related to security is done through systems that provide all the information, processing different data sources. The developing of alternative models that provide complementary information to commercial solutions, based on the same data sources, is presented as a novel and interesting challenge, not only for organizations, but also for the scientific community. This paper presents a new system to classify security threats, computing their criticality according to the Bug Bar technique, with the aim of addressing threats in order of priority. High correlations were achieved between severity risk values achieved from commercial systems and results computed by the new approach. Accordingly, the new proposal could complement the information of SIEM systems, and help in the prediction of criticalities of future threats.

IoTBlockSIEM for information security incident management in the internet of things ecosystem

The Internet unfolded enormous opportunities to the modern computing world where not only humans but also computers and machines, as well as any tiny sensing devices, can communicate and collaborate. The Internet of Things (IoT) is still a new concept in its early stages after 20 years of successful usage in various application domains. Nowadays, the "Internet of Things Ecosystem" term is being used more often that emphasizes its complex internal structure and functionality. Based on the available standards on the IoT’s generalized architecture and reference model, the IoT ecosystem is presented as a security object to be protected. Numerous security controls, collecting raw data for complex and multi-stage processing and further detection of events related to information security (IS), are located on its layers. The IS incident management process with different routine actions for the IoT ecosystems needs automation, for which Security Information and Event Management (SIEM) systems are the best applicable solutions. But modern challenges require modifying two previously known generations of these systems, especially for the IoT ecosystems. A new blockchain-based system called the IoTBlockSIEM is proposed to solve this problem. An example of constructing transactions in the IoTBlockSIEM for the case of its use in managing IS incidents in the IoT ecosystem is provided. Further research concludes the article.

Anomaly Detection Trusted Hardware Sensors for Critical Infrastructure Legacy Devices.

Critical infrastructures and associated real time Informational systems need some security protection mechanisms that will be able to detect and respond to possible attacks. For this reason, Anomaly Detection Systems (ADS), as part of a Security Information and Event Management (SIEM) system, are needed for constantly monitoring and identifying potential threats inside an Information Technology (IT) system. Typically, ADS collect information from various sources within a CI system using security sensors or agents and correlate that information so as to identify anomaly events. Such sensors though in a CI setting (factories, power plants, remote locations) may be placed in open areas and left unattended, thus becoming targets themselves of security attacks. They can be tampering and malicious manipulated so that they provide false data that may lead an ADS or SIEM system to falsely comprehend the CI current security status. In this paper, we describe existing approaches on security monitoring in critical infrastructures and focus on how to collect security sensor–agent information in a secure and trusted way. We then introduce the concept of hardware assisted security sensor information collection that improves the level of trust (by hardware means) and also increases the responsiveness of the sensor. Thus, we propose a Hardware Security Token (HST) that when connected to a CI host, it acts as a secure anchor for security agent information collection. We describe the HST functionality, its association with a host device, its expected role and its log monitoring mechanism. We also provide information on how security can be established between the host device and the HST. Then, we introduce and describe the necessary host components that need to be established in order to guarantee a high security level and correct HST functionality. We also provide a realization–implementation of the HST overall concept in a FPGA SoC evaluation board and describe how the HST implementation can be controlled. In addition, in the paper, two case studies where the HST has been used in practice and its functionality have been validated (one case study on a real critical infrastructure test site and another where a critical industrial infrastructure was emulated in our lab) are described. Finally, results taken from these two case studies are presented, showing actual measurements for the in-field HST usage.

Sustainability and Large-Scale Events: The Case of the Extraordinary Jubilee of Mercy and the Application of Sustainable Development Goals

Large-scale events, which are characterised by a dynamic complexity involving different national public administrations and institutional levels, require special attention in order to select adequate event management systems. Consequently, the analysis of a best practice event may be useful to identify the main variables, in terms of sustainable strategic planning, execution and control –required to achieve the greatest level of efficiency with regard to cost optimisation and quality of service delivery– along with exhorting the public sector to seek a structural renovation that makes better use of its available resources and fosters global sustainable growth. From this perspective, one such relevant experience has been the Italian case of the 2016 Extraordinary Jubilee of Mercy, coordinated by the Prefect of Rome. Indeed, the latter decided to adopt actions consistent with sustainability standards due to an inter-institutional network design and the engagement of institutions at different levels. Within a very short period, the Prefect of Rome achieved three main results: the coordination of the activities of the working groups, the integration of internal and external surveillance and communication systems, and collaboration with higher education institutions to acquire and disseminate knowledge. Accordingly, the aim of this paper is to describe and analyse this best practice event organised and managed by the Italian public administration with reference to the achievement of the UN’s Sustainable Development Goals (SDGs). To systemise and combine the outcomes of these processes, as well as to evaluate whether they were consistent with sustainable development, the systems thinking technique was used. This paper explores the concept of sustainable development and focuses on its traditional social, environmental and economic pillars within the context of planned events such as the 2016 Extraordinary Jubilee of Mercy.

Identification of adverse events in pediatric severe traumatic brain injury patients to target evidence-based prevention for increased performance improvement and patient safety

IntroductionTrauma centres are required to continuously measure, evaluate and improve care. Severe traumatic brain injury (sTBI) patients are highly susceptible to adverse events (AE; unintended, potentially harmful events resulting from health care) due to their unstable condition requiring high risk interventions, multiple medications and invasive monitoring. Objectives were to describe: (1) a process for identifying AE in pediatric sTBI patients to identify safety risks, target and implement evidence-based prevention strategies; and (2) a tertiary care PICU's sTBI AE experience. MethodsMerging databases, Trauma Registry with Adverse Events Management System, identified AE in patients. Details on the event location, type and severity of harm were combined with patient demographics, injury data, costs and outcomes in a cohort of 193 PICU sTBI patients (2000-15). Descriptive statistics and multivariate logistic regression were undertaken to describe AE, and their association with risk factors and outcomes. Results103/193 sTBI patients (53%) suffered at least one AE. 238 AE occurred (1.23 AE/patient), with 30% of patients having 2+ AE. Most resulted in no harm (54%) with decubitus ulcers (15%) the most common AE. AE patients were more likely to be monitored for elevated ICP (p<0.001), with fewer ventilator-free days (p=0.015), longer LOS for PICU (11 vs. 3.5 days; p<0.001) and in-hospital (31 vs. 11 days; p<0.001) with higher median costs ($121,234 vs. $53,341; p=0.031). AE patients required a higher level of care on discharge (p=0.035). ConclusionsMerging databases is an effective practice to identify AE and safety risks in trauma populations. Utilizing this method, a PICU AE rate of 1.23 events per patient was found with TBI severity the most important factor to increase the odds of AE. AE represent performance improvement events, opportunities to optimize care, decrease costs, as well as improve outcomes, to ultimately improve patient safety in this vulnerable population.

Модель системы управления информацией и событиями безопасности

The article is focused on the development of a mathematical model of functioning the security information and event management system known as the SIEM system. This model is a formalized analytical description (in terms of a Markov chain in the form of stochastic differential equations) of the dynamics of the changing states of quality indicators characterizing the essential properties of functioning the security information and events management system in the state space. The model is a system of equations of state and observation, traditional for the Markov chain in the form of finite differences. The scientific task is to improve (modify) the algorithms for converting excitation noise used in the model. A mechanism is proposed for determining the values of the mathematical expectation increment of the simulated process, obtained on the basis of a priori data on the Markov chain, in relation to the mathematical expectation of white Gaussian noise exciting this process. Based on simple calculations the mechanism helps to decide what values can be taken by the elements of the vector of compensation additives in the equation of state of the auxiliary indicator vector of this modified model, taking into account the conversion of the excitation noise. This allows simplifying the model and reducing its computational complexity without significant losses in accuracy (adequacy). The practical application of an improved model is possible both in the framework of the research and in the systems of automated control of information security.

Problems of implementing SIEM systems in the practice of managing information security of economic entities

The aim of the study is to increase the efficiency of information security management of economic entities that use Security Information and Event Management (SIEM) systems by identifying and solving the main problems of introducing these systems into the management of information security practices of economic entities [1-3]. Materials and research methods . Based on the analysis of scheme of the typical architecture of the SIEM system and the standard process of introducing the SIEM system into practice of managing information security of various types of economic entities, the main problems of the installation and configuration of the SIEM system are determined, and ways to solve them are substantiated. During the installation and configuration of the SIEM system, the team of customers and contractors may experience the following typical problems. The process of installing and configuring the SIEM system as part of a systematic approach is considered as a set of interconnected resource-based procedures that implement the installation and configuration of individual components of the SIEM system. Out of the whole set of these procedures, the procedures to be automated are determined. To determine the rational structure of the process of automated installation and configuration of the SIEM system, a method of network planning and management is proposed [4-5], which also allows you to evaluate the effectiveness of implementing the SIEM system in the practice of managing information security of economic entities based on the development and calculation of network schedules. Results. In this work, we developed ways to solve the problems of introducing SIEM systems into information security management practice: simplifying the SIEM system, which is a rejection of rarely used modules and rebuilding the architecture of the SIEM system; automation of the process of typical installation and general setup of the SIEM system, which represents the development of a methodology for automating the procedure of typical installation and general setup of the SIEM system and software module that implements the developed methodology; a combined approach, which is a joint application of the two above approaches, which allows you to bring the SIEM system closer as a product to the “box option. The paper presents reasonable proposals for improving the implementation of the SIEM system, based on the development and application of automated procedures for the typical installation and configuration of the SIEM system, which reduces the time spent on the implementation of the SIEM system, increases the convenience of performing these procedures, and in general can lead to the “boxed version of the solution for a product of this class of information security event management systems. Conclusion. The proposed ways to solve the problems of implementing SIEM systems in the practice of managing information security of economic entities based on the optimization of the installation and configuration of SIEM systems can accelerate the distribution and implementation of information security event management systems and increase efficiency by automating standard installation procedures and SIEM system settings.

Behavioral Economics Incentives to Support HIV Treatment Adherence (BEST): Protocol for a randomized controlled trial in Uganda

BackgroundMany HIV-positive patients do not appropriately adhere to their antiretroviral medication (ART). This leads to higher viral loads and greater probability of HIV transmission. Present bias—a tendency to give in to short-term temptations at the expense of long-term outcomes—is a potential driver of low adherence. In this study we test a novel intervention rooted in behavioral economics that is designed to overcome present bias and increase ART adherence.Methods/designWe will enroll 330 HIV-positive patients at Mildmay Hospital in Kampala, Uganda, into a 2-year randomized controlled trial. Participants will be randomized to one of three groups. The first intervention group (T1, n = 110) will be eligible for small lottery prizes based on timely clinic visits and demonstration of viral suppression. Group 2 (T2, n = 110) will be eligible for the same lottery prizes conditional on high adherence measured by a medication event management system (MEMS) cap. The control group (n = 110) will receive the usual standard of care. Adherence will be measured continuously throughout the intervention period and for 12 months post-intervention to evaluate effect persistence. Surveys will be conducted at baseline and then every 6 months. Viral loads will be measured annually. Primary outcomes are whether the viral load is detectable and MEMS-measured adherence. Secondary outcomes are the log-transformed viral load as a continuous measure and a binary measure for whether the person took at least 90% of their ART pills.DiscussionOur study is one of the first to investigate the effectiveness of lottery incentives for improving ART adherence, and in addition, it compares the relative efficacy of using electronically measured adherence versus viral load to determine lottery eligibility. MEMS caps are relatively costly, whereas viral load testing is now part of routine clinical care in Uganda. BEST will test whether directly incentivizing viral suppression (which can be implemented using readily available clinic data) is as effective as incentivizing electronically measured adherence. Cost-effectiveness analyses of the two implementation modes will also be performed.Trial registrationClinicalTrials.gov, NCT03494777. Registered on 11 April 2018.

Construction and application of non-punitive nursing adverse event management system in primary hospital

Objective To construct a non-punitive nursing adverse event management system and explore the effects of the system in the management of adverse events in primary hospitals. Methods By convenient sampling, 71 967 patients who were hospitalized in the first 2 years of the introduction of the adverse event reporting system from January 2015 to December 2016 were selected as the control group, the Department of Nursing unified adverse event table was sent to the hospital OA system, adverse events are reported to the Department of Nursing; a total of 73 002 patients hospitalized after the direct reporting system was enabled from January 2017 to December 2018 were the experimental group. Comparing the reported rate of adverse events, adverse event grading, categories, and fall/falling injury rates between the two groups. Results A total of 811 adverse events were reported in the experimental group, which was higher than 715 in the control group, the difference between the two groups was statistically significant (χ2=5.685, P=0.017) . There was a statistically significant difference in the levels of adverse events incidence between the experimental group and the control group (P<0.05) . The number of cases of drug extravasation and specimen-related events increased in the experimental group, and the number of needlestick and scald events decreased, the difference between the two groups were statistically significant (P<0.05) . The incidence of Grade Ⅲ injury in the fall/fall of the test group was 3.1% (5/159) , which was lower than that of the control group (11.6%, 15/129) , the difference between the two groups was statistically significant (P<0.05) . Conclusions The non-punitive direct reporting system is conducive to creating a safe culture atmosphere for hospital care, increasing the active reporting rate of adverse events, reducing the level of adverse events and injury, changing the composition ratio of adverse events, thereby improving the efficiency of nursing management and continuously improving the quality of care. Key words: Nursing administration; Nursing adverse event; Non-punitive management system; Primary hospitals

Approaches to find vulnerabilities and security in the digital production networks

Currently, the problem of ensuring cybersecurity of the network and information infrastructure of critical facilities is relevant. A special place in this is security automated control systems, which are the basis of industry 4.0. At the same time, the main source of threats to such systems is the external network of the telecommunications service provider, through which the operation of remote objects and systems is monitored. In the framework of this study, an approach was developed to search for abnormal behavior in the networks of telecommunication service providers, based on an analysis of events in the logs of various systems, including those responsible for network security. The proposed approach is the development of an information and event management system.