Security Event Management Systems Research Articles

Fuzzy models for cyber incident detection in military information and communication systems databases

Protecting databases of military information and communication systems is an extremely important task in the modern cybersecurity sphere. Growing threats from cyberattacks, the need to effectively detect, counteract and prevent them require the use of new, more effective models and methods. The main disadvantages of existing models and methods include insufficient sensitivity to new threats, a large number of detection errors, low response to new threats, the possibility of bypassing protective measures, and low scalability, which are key challenges for further improvement and development of cybersecurity. The article analyzes the existing fuzzy models for detecting cyber incidents, identifies their shortcomings and emphasizes the need for their further improvement and development. An improved fuzzy model for detecting cyber incidents in databases of military information and communication systems and an improved fuzzy model for detecting cyber incidents in databases of military information and communication systems with weighted rules based on the expansion of cyber incident signs by obtaining them from different levels of cyber security of the data are proposed. The main levels of database cybersecurity include: the operating system level, the network level, and the database management system level. To eliminate the shortcomings associated with the false triggering of cyber incident detection rules and the complexity of their configuration in a dynamically changing cyberattack landscape, as well as the dimensionality of the knowledge base of the information and security event management system, a fuzzy model for detecting cyber incidents in databases of military information and communication systems with weights of rule antecedents is proposed. The expediency of applying the developed model is shown.

Evaluation of Local Security Event Management System vs. Standard Antivirus Software

The detection and classification of threats in computer systems has been one of the main problems researched in Cybersecurity. As technology evolves, the tactics employed by adversaries have also become more sophisticated to evade detection systems. In consequence, systems that previously detected and classified those threats are now outdated. This paper proposes a detection system based on the analysis of events and matching the risk level with the MITRE ATT&CK matrix and Cyber Kill Chain. Extensive testing of attacks, using nine malware codes and applying three different obfuscation techniques, was performed. Each malicious code was analyzed using the proposed event management system and also executed in a controlled environment to examine if commercial malware detection systems (antivirus) were successful. The results show that evading techniques such as obfuscation and in-memory extraction of malicious payloads, impose unexpected difficulties to standard antivirus software.

ИССЛЕДОВАНИЕ ИНДИКАТОРОВ КОМПРОМЕТАЦИИ ДЛЯ СРЕДСТВ ЗАЩИТЫ ИНФОРМАЦИОННЫХ И КИБЕРФИЗИЧЕСКИХ СИСТЕМ

Purpose of work: study of existing standards of compromise indicators and methods of their exchange for enrichment of protection systems of information and cyber-physical systems. Research method: systematic analysis of open sources of data on indicators of compromise, standards of their description and methods of exchange in the organization of cyberintelligence. The result obtained: the actual problems of proactive search of threats are formulated on the example of the application of open sources of indicators of compromise in the processing of event flows in security event management systems. The classification of indicators derived from internal sources is proposed. The main problems of processing dynamic threat data streams under changing attack vectors are formulated. It was found that the threat intelligence industry currently lacks a unified solution in terms of standardization of information exchange between different platforms, but there are a number of dominant standards and formats of such data exchange. In the course of preparing the review of existing, the tasks of identifying previously unknown attack methods based on the use of open sources of indicators of compromise in data processing in security incident management systems were considered and structured, and methods for their solution were proposed. Scientific novelty: the presented article is one of the first domestic works, devoted to the analysis of research in recent years in the field of organization of work with threat intelligence data sources. Reviewed and systematized the sources of indicators of compromise and proposed their classification. Formulated the main problems of processing dynamic threat data streams under conditions of variable attack vectors.

Problems of implementing SIEM systems in the practice of managing information security of economic entities

The aim of the study is to increase the efficiency of information security management of economic entities that use Security Information and Event Management (SIEM) systems by identifying and solving the main problems of introducing these systems into the management of information security practices of economic entities [1-3]. Materials and research methods . Based on the analysis of scheme of the typical architecture of the SIEM system and the standard process of introducing the SIEM system into practice of managing information security of various types of economic entities, the main problems of the installation and configuration of the SIEM system are determined, and ways to solve them are substantiated. During the installation and configuration of the SIEM system, the team of customers and contractors may experience the following typical problems. The process of installing and configuring the SIEM system as part of a systematic approach is considered as a set of interconnected resource-based procedures that implement the installation and configuration of individual components of the SIEM system. Out of the whole set of these procedures, the procedures to be automated are determined. To determine the rational structure of the process of automated installation and configuration of the SIEM system, a method of network planning and management is proposed [4-5], which also allows you to evaluate the effectiveness of implementing the SIEM system in the practice of managing information security of economic entities based on the development and calculation of network schedules. Results. In this work, we developed ways to solve the problems of introducing SIEM systems into information security management practice: simplifying the SIEM system, which is a rejection of rarely used modules and rebuilding the architecture of the SIEM system; automation of the process of typical installation and general setup of the SIEM system, which represents the development of a methodology for automating the procedure of typical installation and general setup of the SIEM system and software module that implements the developed methodology; a combined approach, which is a joint application of the two above approaches, which allows you to bring the SIEM system closer as a product to the “box option. The paper presents reasonable proposals for improving the implementation of the SIEM system, based on the development and application of automated procedures for the typical installation and configuration of the SIEM system, which reduces the time spent on the implementation of the SIEM system, increases the convenience of performing these procedures, and in general can lead to the “boxed version of the solution for a product of this class of information security event management systems. Conclusion. The proposed ways to solve the problems of implementing SIEM systems in the practice of managing information security of economic entities based on the optimization of the installation and configuration of SIEM systems can accelerate the distribution and implementation of information security event management systems and increase efficiency by automating standard installation procedures and SIEM system settings.

МЕТОДИКИ И ПРОГРАММНЫЙ КОМПОНЕНТ ОЦЕНКИ РИСКОВ НА ОСНОВЕ ГРАФОВ АТАК ДЛЯ СИСТЕМ УПРАВЛЕНИЯ ИНФОРМАЦИЕЙ И СОБЫТИЯМИ БЕЗОПАСНОСТИ

МЕТОДИКИ И ПРОГРАММНЫЙ КОМПОНЕНТ ОЦЕНКИ РИСКОВ НА ОСНОВЕ ГРАФОВ АТАК ДЛЯ СИСТЕМ УПРАВЛЕНИЯ ИНФОРМАЦИЕЙ И СОБЫТИЯМИ БЕЗОПАСНОСТИ