Information Security Events Research Articles

Организация мониторинга сетевых вторжений на основе свободно распространяемого программного обеспечения

This paper presents the results of preparing a virtual bench for modeling and detecting network attacks using a freely distributed intrusion detection system (IDS). The relevance of the work is related to the growing demand for IDS as sources of information security events for security information and event management (SIEM) systems. A comparative analysis of the most popular freely distributed open-source network IDSs was carried out and the choice of the Zeek system for its use in the project was substantiated. The work uses Zeek network logs, which contain important and structured information about the analyzed network traffic. The laboratory bench was built on the basis of a Linux virtual machine and a Mininet network simulator. A graphical representation of the developed virtual stand is proposed. An experimental study of the effectiveness of an intrusion detection system is demonstrated by simulating a network denial of service attack and further analyzing the received network traffic using IDS tools.

Алгоритмы и методы кластеризации данных в анализе журналов событий информационной безопасности

Security event log files give an idea of the state of the information system and allow you to find anomalies in user behavior and cybersecurity incidents. The existing event logs (application, system, security event logs) and their division into certain types are considered. But automated analysis of security event log data is difficult because it contains a large amount of unstructured data that has been collected from various sources. Therefore, this article presents and describes the problem of analyzing information security event logs. And to solve this problem, new and not particularly studied methods and algorithms for data clustering were considered, such as Random forest (random forest), incremental clustering, IPLoM algorithm (Iterative Partitioning Log Mining - iterative analysis of the partitioning log). The Random forest algorithm creates decision trees for data samples, after which it is provided with a forecast for each sample, and the best solution is selected by voting. This method reduces overfitting by averaging the scores. The algorithm is also used in such types of problems as regression and classification. Incremental clustering defines clusters as groups of objects that belong to the same class or concept, which is a specific set of pairs. When clusters are defined, they can overlap, allowing for a degree of "fuzziness for samples" that lie at the boundaries of different clusters. The IPLoM algorithm uses the unique characteristics of log messages to iteratively partition the log, which helps to extract message types efficiently.

ПРОГРАМНІ МЕТОДИ МОНІТОРИНГУ МЕРЕЖЕВОЇ БЕЗПЕКИ

The software methods for monitoring network security (NSM - Network Security Monitoring) are discussed. With the growth and rapid development of mobile communications, rich data and artificial intelligence technologies, we are entering the era of the mobile Internet. With the continuous intellectualization of network security and infrastructure, information technology is widely used in the field of industrial control, making network security more and more open, bringing a new network security control system to the traditional relatively closed industrial control system. Currently, there is an increase in the number of information threats and factors leading to the unstable operation of data transmission networks. The prerequisites for this growth are the mass application, the complication of the hierarchy of computer networks and the increase in their structural complexity, the increase in the heterogeneity of software and hardware, the complication of the functionality of network services, which leads to the emergence of various vulnerabilities. Under such conditions, the development and improvement of methods for identifying information threats are of great importance. One of the components of ensuring information protection of networks is software systems designed to detect harmful or suspicious activity - network security monitoring methods (NSM). Network security monitoring techniques (NSM) are used to monitor network 133 communications for information security events. For maximum effect, a combination of capturing the entire packet in addition to logging network activity is recommended. This article provides definitions of network security monitoring methods, their classification, phases of the method cycle and their description. Some of the best known and widely used multi-module NSM solutions have been reviewed. The best known examples of such combinations are IDS/IPS, SEM/SIEM and UTM. Network security monitoring is important because it checks if the first lines of defense are working, gives us the opportunity to eliminate threats before they cause real damage if there is a vulnerability somewhere in your system, and allows us to understand where these vulnerabilities are and how to fix them before something will happen.

VISUALIZATION AND PROCESSING OF INFORMATION SECURITY EVENTS BASED ON CICIDS DATA 17

At present, attacks on computer networks continue to develop at a speed that outstrips the ability of information security specialists to create new attack signatures. This article illustrates an approach to preprocessing raw data and visualizing information security events in a live dataset. It is shown how preprocessing and primary knowledge extraction for further use of the processed dataset in machine learning models can be used in the design of machine learning models for intrusion detection systems. A distinctive feature of the work is that the most relevant set CICIDS17 was taken as the studied dataset. Although traditionally considered popular such kits as DARPA2000 and KDD-99, which are more than 20 years old. The article also describes the criteria and characteristics that the set has.

The development of models of an analytical data processing system for monitoring information security of an informatization object using cloud infrastructure

The article is devoted to the problem of developing an analytical data processing system for monitoring information security within the information security management system of modern companies conducting their main activities in cyberspace and using cloud infrastructure. Based on the analysis of modern information technologies related to ensuring information security of cloud infrastructure and the most popular products for ensuring information security of cloud infrastructures, as well as existing scientific approaches, a formalized approach to the synthesis of an analytical data processing system for monitoring the information security of an informatization object using cloud infrastructure is proposed. This approach takes into account the usefulness of the used information technologies from the viewpoint of information security. A general model of the structure of information support of an analytical data processing system for monitoring information security, as well as a model of the dependence of the usefulness of information technology on time and the ratio of the skill level of an information security specialist and an attacker are presented. The quality of the information security monitoring system is used as a criterion in the first optimization model. The following limitations are suggested: limitation on the time of making a decision on an incident; limitation on the degree of quality of analysis of information security events by the analytical data processing system and limitation on the compatibility of data analysis functions with data types about information security events. The cited results of the study of the second model show a logically consistent dependence of the usefulness of information technology on time and the ratio of the skill level of an information security specialist to the skill level of an attacker. The particular models of the structure of the information support of ASOD are presented. They make it possible to determine the rational structure information support of ASOD according to particular criteria. The following particular criteria are used: the maximin criterion of the usefulness of the information support of ASOD for monitoring the information security of an informatization object in the cloud infrastructure; the criterion for the maximum relevance of information support distributed over the nodes of the cloud infrastructure for systems with a low degree of centralization of management.

Stock market reactions to favorable and unfavorable information security events: A systematic literature review

The rapid digital transformations across every industry sector, accelerated partly due to the COVID-19 pandemic, have increased organizations’ use of information systems for operational and strategic purposes. These organizational responses have led to a confluence of digital, biological, and physical technologies that are revolutionizing business practices and workflows. But accompanying the pervasive use of digital technologies and the evolutionary nature of digital assets, is a shifting world of cyberattacks and information security (ISec) cybercrimes. Dynamic cybercrimes make it increasingly difficult for managers and researchers to anticipate the types, magnitude, and severity of future information security (ISec) breaches. Thus, we perform a systematic literature review (SLR) that explores, gathers, and categorizes event studies to examine the influence of favorable and unfavorable ISec events on stock markets. We extend the research conducted by Spanos and Angelis (2016) and provide a comprehensive understanding of the market’s efficiency to process public information released about ISec events, ISec contingency factors, and the influence of ISec events on stock prices and factors other than price. Our systematic search reveals 58 relevant papers that include 80 studies. We find that in 75% of the studies ISec events can significantly affect a company’s stock market performance, and that such effects are primarily exhibited within two days before and after the event day. Further, the magnitude of abnormal returns is higher in studies examining unfavorable ISec events, such as ISec breaches, compared to abnormal returns from favorable events, such as ISec investments and ISec certifications. In the end, our SLR serves as a foundation for ISec and management communities to build upon to keep industry and academia apprised of continually developing trends, new attack vectors and types of data breaches, protective ISec behaviors and programs, and their subsequent influences on stock market values and returns.

Information Security Field Event Detection Technology Based on SAtt-LSTM

Detecting information security events from multimodal data can help analyze the evolution of events in the security field. The Tree-LSTM network that introduces the self-attention mechanism was used to construct the sentence-vectorized representation model (SAtt-LSTM: Tree-LSTM with self-attention) and then classify the candidate event sentences through the representation results of the SAtt-LSTM model to obtain the event of the candidate event sentence types. Event detection using sentence classification methods can solve the problem of error cascade based on pipeline methods, and the problem of CNN or RNN cannot make full use of the syntactic information of candidate event sentences in methods based on joint learning. The paper treats the event detection task as a sentence classification task. In order to verify the effectiveness and superiority of the method in this paper, the DuEE data set was used for experimental verification. Experimental results show that this model has better performance than methods that use chain structure LSTM, CNN, or only Tree-LSTM.

Analysis of information security events based on cicids data 17

The article presents a methodology for developing an Intrusion Detection Assessment Module based on CICIDS17 data. The article presents the numerical results of the designed module, as well as indicators of its performance. The CICIDS17 data-driven attack analyzer series of articles fills the gap in using the original dataset to develop an efficient machine learning engine for identifying information security events.

Моделювання роботи групи реагування на інциденти інформаційної безпеки в умовах зростання інтенсивності кібератак

Modeling of the Information Security Incident Response Team (ISIRT) functioning and decision-making in the process cyberattacks requires the simultaneous use of parameters and characteristics at, on the one hand, directly characterize cyberattacks and their deployment over time, and, on the other hand, require taking into account the parameters and indicators that characterize the activities of specialists in a stressful situation. ISIRT’s activities are to counter cyberattacks aimed at destabilizing the social state of society by disseminating harmful information. The paper builds a model to describe the features of the ISIRT, taking into account the impact of the parameter of increasing the intensity of information security incidents on the quality of analysis of the system in real time, using the functions of responding to information security violations. The peculiarity of the constructed model is that for the first time the overload mode is taken into account, i.e. the influence of the introduced parameter of increasing the intensity of information security event identification is taken into account. The conditions under which the ISIRT is transitioning to a regime that does not meet the sufficient criterion of ergodicity, when the group will not be able to effectively cope with the deployment of cyber attacks in time. Simulation modeling of ISIRT activity is carried out and the presence of transition to the mode, which is caused by the lack of ergodic property of the system functioning, when changing the parameter of increasing the intensity of information security event identification, is shown. The obtained results allow predicting the appearance of the overload mode caused by the lack of ergodic properties of the system operation, in the conditions of which the activity of this ISIRT ceases to be effective. This allows you to set certain thresholds for the time of effective operation of this ISIRT during a cyber attack. As a result, the existing set of ISIRT can be characterized by certain quantitative indicators that characterize the time of effective operation of this ISIRT, depending on the identified characteristics of the cyber attack. Based on the developed model, new methods of countering cyberattacks can be developed, which will be based on identifying the required characteristics of the temporal deployment of cybersecurity incidents and on their basis redirecting control from one ISIRT to another during the incident. This will require the creation of a database with the necessary characteristics for those ISIRTs that may be involved in the process of countering cyberattacks.

A Key Business Node Identification Model for Internet of Things Security

Based on the research of business continuity and information security of the Internet of Things (IoT), a key business node identification model for the Internet of Things security is proposed. First, the business nodes are obtained based on the business process, and the importance decision matrix of business nodes is constructed by quantifying the evaluation attributes of nodes. Second, the attribute weights are improved by the analytic hierarchy process (AHP) and entropy weighting method from subjective and objective dimensions to form the combination weight decision matrix, and the analytic hierarchy process and entropy weighting VIKOR (AE-VIKOR) method are used to calculate the business node importance coefficient to identify the key nodes. Finally, according to the NSL-KDD dataset, the network security events of IoT network intrusion detection based on machine learning are monitored purposefully, and after the information security event occurs in the smart mobile phone, which impacts through IoT on the business system, the impact of the key business node on business continuity is analyzed, and the business continuity risk value is calculated to evaluate the business risk to prove the effectiveness of the model. The experimental results of the civil aviation departure business show that the AE-VIKOR method can effectively identify key business node, and the impact of the key business node on business continuity is analyzed, which further proves the efficiency and accuracy of the model in identifying the key business node.

The Effect of Data Theft on a Firm’s Short-Term and Long-Term Market Value

The prevalence of the internet as firm’s primary channel of operations and marketing in recent decades has made information security management a critical issue for firms. Yet, previous research on the information security issue have mostly focused on the impact of information security events on firms’ short-term value. Their impact on firms’ long-term value is rarely analyzed. Corporate managers have also largely dismissed the negative long-term impact of information security breaches by considering them as accidental and arguing that their frequency in recent years has instigated a sense of numbness in customers to their regards. Consequently, managers have paid little attention to information security investments. To assess the importance of information security investment, this study examines short-term and long-term stock market assessment of data breaches events at publicly traded companies. The findings of this study offer new insights for firms in assessing information security investment.

Problems of implementing SIEM systems in the practice of managing information security of economic entities

The aim of the study is to increase the efficiency of information security management of economic entities that use Security Information and Event Management (SIEM) systems by identifying and solving the main problems of introducing these systems into the management of information security practices of economic entities [1-3]. Materials and research methods . Based on the analysis of scheme of the typical architecture of the SIEM system and the standard process of introducing the SIEM system into practice of managing information security of various types of economic entities, the main problems of the installation and configuration of the SIEM system are determined, and ways to solve them are substantiated. During the installation and configuration of the SIEM system, the team of customers and contractors may experience the following typical problems. The process of installing and configuring the SIEM system as part of a systematic approach is considered as a set of interconnected resource-based procedures that implement the installation and configuration of individual components of the SIEM system. Out of the whole set of these procedures, the procedures to be automated are determined. To determine the rational structure of the process of automated installation and configuration of the SIEM system, a method of network planning and management is proposed [4-5], which also allows you to evaluate the effectiveness of implementing the SIEM system in the practice of managing information security of economic entities based on the development and calculation of network schedules. Results. In this work, we developed ways to solve the problems of introducing SIEM systems into information security management practice: simplifying the SIEM system, which is a rejection of rarely used modules and rebuilding the architecture of the SIEM system; automation of the process of typical installation and general setup of the SIEM system, which represents the development of a methodology for automating the procedure of typical installation and general setup of the SIEM system and software module that implements the developed methodology; a combined approach, which is a joint application of the two above approaches, which allows you to bring the SIEM system closer as a product to the “box option. The paper presents reasonable proposals for improving the implementation of the SIEM system, based on the development and application of automated procedures for the typical installation and configuration of the SIEM system, which reduces the time spent on the implementation of the SIEM system, increases the convenience of performing these procedures, and in general can lead to the “boxed version of the solution for a product of this class of information security event management systems. Conclusion. The proposed ways to solve the problems of implementing SIEM systems in the practice of managing information security of economic entities based on the optimization of the installation and configuration of SIEM systems can accelerate the distribution and implementation of information security event management systems and increase efficiency by automating standard installation procedures and SIEM system settings.

МОДЕЛЮВАННЯ ХАРАКТЕРИСТИК ОБЛАДНАННЯ КОМП’ЮТЕРНИХ МЕРЕЖ У РАКУРСІ ІНФОРМАЦІЙНОЇ БЕЗПЕКИ

The study focuses on the development of models for analyzing and assessing information security risks in computer networks that are used in the development of enterprise information security systems and in auditing the level of protection of already existing information systems, the development of a family of security models of computer network communications equipment. The developed algorithms and models have been implemented in the system of analysis and correction of information security violations, the use of which has allowed to reduce the time of correction of the consequences of such violations. The basic elements of violations, which are described by the information structure and determine the influence on the activity of information systems, are revealed. It is determined that most information security events are related to the communication equipment of the computer networks on which the information systems operate. Further research has been aimed at finding and developing security models for communication levels of operation of computer networks and a system for correcting information security violations. To implement the algorithm, a number of models, that describe the characteristics of network equipment in the security perspective, have been developed. The model of switch security describes the switch characteristics that affect the security and reliability of the network infrastructure. The tunneling security model reflects the security of the gateway portion of the deployed VPN tunnel. The intrusion detection security model involves the use of a compatible model with the shielding model, namely extending the state-based filtering parameter. The routing security model considers the types and protocols of routing. The use of models in the correcting system of the consequences of information security violations has made it possible to fully or partially automate the response to security events occurring in information systems. The developed models allow to take into account the peculiarities of the information system, the nature of the threat scenarios and the features of the network equipment.

КЛАСТЕРИЗАЦІЯ ОЗНАК МЕРЕЖЕВИХ АТАК В ЗАДАЧАХ АНАЛІЗУ ЗАХИЩЕНОСТІ ІНФОРМАЦІЇ

The paper proposes an algorithm with self-learning elements for intrusion detection systems, as well as an improved clustering technique which is recorded by the data system concerning information security events. The proposed approaches differ from those known using an entropy approach allowing data to be presented as homogeneous groups, moreover, each such group (or cluster) may correspond to predetermined parameters. The proposed solutions relate to the possibilities of assessing dynamic dependencies between clusters characterizing the analysed classes of invasions. The studies have found that in case of manifestation of new signs of information security events, the corresponding scale changes and describes the distances between clusters. A computational experiment was conducted to verify the operability and adequacy of the proposed solutions. During the computational experiment, it has been found that step-by-step calculation of parameters of informative characteristics of network attacks allows to form sufficiently informative cluster structures of data having characteristic attributes. These attributes further become the basis for the knowledge base of intelligent network attack detection systems. Dynamic dependencies between clusters are calculated allowing for a sufficiently accurate definition of the many information security events that can become the source data for further automatic assessment of current threats extent detected by attack detection systems. The methodology and algorithm presented in the paper for clustering the signs of network attacks, in our opinion it is simpler for software implementation than existing analogues.

МЕТОДИКА АНАЛИТИЧЕСКОЙ ОБРАБОТКИ РАСПРЕДЕЛЕННЫХ ВО ВРЕМЕНИ ИНЦИДЕНТОВ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ

The process of analytical processing of information security incidents has several drawbacks described in this article. A structural model of the subsystem of analytical data processing of the monitoring system of a threat to the information security of the objects of critical information infrastructure is built and the process of its functioning is described. Based on probability theory, a process is described for predicting the occurrence of an information security incident in advance, due to both random and independent information security events, and a targeted attack on information resources. The subject of the article is the methodology of analytical processing of information security events in the monitoring system, a threat to the information security of critical information infrastructure facilities. The purpose of the article is to increase the likelihood of detecting an information security incident by retrospectively analyzing information security events distributed over time, and to timely warn of a possible occurrence of an information security incident by predicting its occurrence, which in turn leads to an increase in the security of information systems. Thus, in contrast to the existing model of correlation of information security events, to reduce the time of detection of an information security incident in a given time interval. The research methodology allows us to solve two related but different tasks: “accounting problem” and “probabilistic problem”. Within the framework of the “accounting task”, the solution boils down to one goal — to determine the proportion of the occurrence of an information security incident at various levels of its occurrence. As part of the solution of the “probabilistic problem”, the methodology determines the probability of an information security incident on the basis of an accidental receipt of information security event chains at the entrance. The research results allow us to eliminate the shortcomings of existing systems for detecting computer attacks, such as distributed over time, and also to apply the developed methodology to create advanced tools for automated systems that can function stably under conditions of conducting distributed time attacks of computer attacks.

Architecture and functional model of a perspective proactive intellectual siem for cyber protection of objects of critical infrastructure

The article deals with the current, nowadays, issues of cyber defense of critical infrastructure, which are becoming increasingly important. Based on the analysis, it is concluded that the basis of building an effective cyber defense system is the use of information management and security event management (SIEM). The use of systems of this type allows not only to detect cyber security incidents, but also to predict them based on the accumulated data in the system. The proposed new architecture for a promising proactive smart SIEM, which, in addition to the traditional levels of data collection, management and analysis, includes the fourth level - the level of decision making and implementation. The implementation of the proposed architecture is possible through the development and application of new methods of normalization, filtering, classification, aggregation, correlation, prioritization and analysis of events and cyber security incidents, their consequences, generation of various reports, messages and visual presentation of data for operational and substantiated adoption based on data mining technologies, machine learning, Big Data processing and artificial intelligence. A new functional model of a promising intelligent SIEM is proposed, which includes: subsystem of collection and primary processing of data from heterogeneous sources; data management subsystem; the data analysis subsystem and the decision and implementation subsystem. The implementation of the model allows to minimize human participation in solving the problem of responding to cyber incidents, thereby increasing the efficiency and validity of the decisions it makes. The application of the proposed new architecture of a proactive intellectual SIEM and its functional model, allows to take a new step in the evolution of type towards increasing the efficiency of their use in cyber defense systems of critical infrastructure.

Cyber Security - Incident Response and Management

Today, Information Technology has bought a lot of benefits for the mankind but it has also made us susceptible to failures and attacks as well. This article discusses the increasing complexity of cyber- security threats and capabilities of information security teams in applying controls required to effectively respond to threats. In this article, the main stages of managing information security incidents and events are discussed, designed to help create an effective response process to security incidents and as a result to reduce losses and quickly restore performance in dynamically changing IT infrastructure and threat landscape.

Cyber Security - Incident Response and Management

Today, Information Technology has bought a lot of benefits for the mankind but it has also made us susceptible to failures and attacks as well. This article discusses the increasing complexity of cyber- security threats and capabilities of information security teams in applying controls required to effectively respond to threats. In this article, the main stages of managing information security incidents and events are discussed, designed to help create an effective response process to security incidents and as a result to reduce losses and quickly restore performance in dynamically changing IT infrastructure and threat landscape.

ПОСТРОЕНИЕ АНАЛИТИЧЕСКОЙ СИСТЕМЫ АНАЛИЗА СОБЫТИЙ ДЛЯ ОБЕСПЕЧЕНИЯ ИНФОРМАЦИОННОЙ БЕЗОПАСНОСТИ ПРЕДПРИЯТИЯ

The task of ensuring information security of critical information structures in the Russian Federation is brought to the state level. It requires ensuring the security of information systems, communication networks and technological systems. To prevent possible incidents and meet the requirements of the state the organizations should create a security system for the critical information structures, ensure its functionality, and connect it to National coordination center for computer incidents in order to collect and exchange information about computer attacks. In this paper the authors present an approach to the development of an analytical system for information security based on machine learning, which allow analyzing a large number of events and making informed decisions on information security management. A list of the main sources of information security events of systems and networks was worked out, and a classification of events for further analysis using machine learning was proposed. By classifying the events obtained from different systems, as well as applying an integrated approach to assessing the situation, it is possible to draw a conclusion about the state of the entire object to be protected in real time.

Improving the Methods for Protecting Information from Unauthorized Access

The research relevance is conditioned by the constantly growing technical capabilities for unauthorized access to protected information in the local area networks (LAN), the development of methods of attacks, and therefore, the need to improve methods of information protection. The paper describes the peculiarities of using the system of collecting and correlating information security events SIEM (Security Information and Event Management), which detects and notifies about the emergence of threats to leakage of protected information. In the modern world, due to the ever-growing technical capabilities of attackers for unauthorized access to LAN, improving the ways of carrying out attacks on them, there is a need to improve the existing methods of information protection and to develop new ones. In addition to the technical component, an important risk factor is the human factor, due to which up to 52 % of information leaks (intentional and unintended) occur around the world. They are distributed by categories of information: 62.3 % – personal data, 31.0 % – payment documents, 3.9 % – state secrets, 2.8 % – trade secrets.