Security Information And Event Management Research Articles

Leveraging Microsoft sentinel and logic apps for automated cyber threat response

An integrated approach to automated cyber threat response is explored in this paper, with Microsoft Sentinel's Security Information and Event Management (SIEM) capabilities being leveraged alongside Logic Apps' workflow automation within the Azure ecosystem. Efficient identification and automated mitigation of security incidents are enabled by a combination of AI-driven analytics and advanced threat-hunting capabilities, resulting in a substantial reduction of manual intervention and response times. The approach is demonstrated to contribute scientifically across three core areas: (1) a novel integration of Sentinel's SIEM with Logic Apps is proposed to streamline response workflows using automated playbooks; (2) the effectiveness of the system is assessed through multiple cyber threat scenarios, including automated account blocking and virtual machine isolation in response to identified threats; and (3) Sentinel's performance is evaluated relative to other SIEM solutions, such as Splunk and IBM QRadar, particularly in Azure-centric and hybrid environments. The potential of Microsoft Sentinel and Logic Apps to advance proactive cybersecurity defenses is underscored, while key limitations in scalability and cross-platform adaptability are also identified.

Wazuh SIEM for Cyber Security and Threat Mitigation in Apparel Industries

Security of IT infrastructure is critical in the modern digital environment, particularly for industries that manufacture clothing. The application of the Wazuh Security Information and Event Management (SIEM) system to improve security monitoring and compliance for an IT system in the apparel industry is the main topic of this study. To improve the apparel industry cyber threat monitoring system in real-time monitoring, detecting the threat vectors that support the centralized management system, to meet these objectives of the company, an SIEM security management system has been installed and configured with the components of Wazuh manager, indexer, Wazuh agent, and Wazuh dashboard as well. An Oracle virtual lab environment was created to install and configure the Wazuh system a robust Linux operating system was installed at the server level and Windows 10 was installed on the client end to the authenticity failure of the security system. To implement the Wazuh system, the project management guideline was followed which ensured the planning and implementation of the project, testing phases, and along with review and maintenance. Wazuh security management system successfully identified the authentical failure reports and vulnerabilities and generated automated reports from the system that showed the result of 1 critical, 19 high, and 5 medium levels of vulnerabilities shown in Figure 6, and the necessary patch recommended to solve the critical issues. On the other hand, the system also generated security events as well as integrity monitoring system reports. The deployment of the Wazuh security management system ensured the robust cost-effective security management system with high quality for detecting cyber threats which supports the regulatory and compliance requirements and is a viable tool for the apparel industry to protect the stakeholders’ interest.

Implementasi Sistem Manajemen Log untuk Penanggulangan Serangan Server dengan SIEM

In the current digital era, information security has become a primary focus for organizationsworldwide. Rapid technological advancements have brought significant benefits but alsointroduced increasingly sophisticated cyber threats and attacks. One approach to addressing thesechallenges is through Security Information and Event Management (SIEM). SIEM integratesSecurity Information Management (SIM) and Security Event Management (SEM) to collect,analyze, and report security data from various network sources, enabling more effective detection,response, and management of security incidents. This study focuses on handling server attacksusing Wazuh SIEM as an early warning system. The methodology involves setting up a networktopology to detect Distributed Denial of Service (DDoS) attacks using SIEM, collecting andanalyzing log data, correlating data to identify threats, and responding to detected threats. Theresults indicate that SIEM is crucial in modern cybersecurity, providing real-time threat detectionand response capabilities. The system successfully detected and blocked 42 attacks during thetrial. In conclusion, SIEM offers greater security visibility and control, enabling organizations todetect and respond to complex security threats efficiently and effectively. Modern SIEM systems,equipped with advanced analytics and machine learning, can identify anomaly patterns and newthreats, thus strengthening an organization's cybersecurity defenses.

Integrating Security Information and Event Management (SIEM) with Data Lakes and AI: Enhancing Threat Detection and Response

The evolving threat landscape in cybersecurity necessitates more advanced and efficient solutions for threat detection and response. Traditional Security Information and Event Management (SIEM) systems have limitations in handling large volumes of data and identifying sophisticated threats. This research explores the integration of SIEM solutions with data lakes, offering a scalable and flexible approach to managing security data. By leveraging artificial intelligence (AI) and machine learning (ML) algorithms, SIEM platforms can enhance their capabilities in real-time threat detection, automated response, and advanced analytics. This integration enables organizations to process vast amounts of structured and unstructured data from various sources, improving both the speed and accuracy of identifying security threats. The article examines the architecture, benefits, and challenges of combining SIEM with data lakes and AI, providing insights into how these technologies can collectively strengthen organizational security postures.

Machine learning algorithms in SIEM systems for enhanced detection and management of security events

As cyber threats become increasingly sophisticated, traditional Security Information and Event Management (SIEM) systems face challenges in effectively identifying and responding to these dangers. This research presents the development of a SIEM system integrated with machine learning (ML) to enhance threat detection, anomaly identification, and automated incident response. The integration of ML allows the SIEM system to go beyond conventional rule-based approaches, enabling the detection of previously unknown threats by learning from historical data. The system employs advanced algorithms to analyze large-scale log data and network traffic, providing real-time insights and reducing false positives. Key features of this SIEM include anomaly detection, predictive analytics, and adaptive thresholds, which allow it to adjust dynamically based on contextual data. By adapting to new and evolving cyber threats, the system provides a more resilient and proactive defense against potential attacks. The results indicate that integrating machine learning into SIEM systems can offer organizations a more effective, scalable, and adaptive security solution, ensuring the protection of critical infrastructure and data in a rapidly changing digital landscape.

Revolutionizing SIEM Security: An Innovative Correlation Engine Design for Multi-Layered Attack Detection.

Advances in connectivity, communication, computation, and algorithms are driving a revolution that will bring economic and social benefits through smart technologies of the Industry 4.0 era. At the same time, attackers are targeting this expanded cyberspace to exploit it. Therefore, many cyberattacks are reported each year at an increasing rate. Traditional security devices such as firewalls, intrusion detection systems (IDSs), intrusion prevention systems (IPSs), anti-viruses, and the like, often cannot detect sophisticated cyberattacks. The security information and event management (SIEM) system has proven to be a very effective security tool for detecting and mitigating such cyberattacks. A SIEM system provides a holistic view of the security status of a corporate network by analyzing log data from various network devices. The correlation engine is the most important module of the SIEM system. In this study, we propose the optimized correlator (OC), a novel correlation engine that replaces the traditional regex matching sub-module with a novel high-performance multiple regex matching library called "Hyperscan" for parallel log data scanning to improve the performance of the SIEM system. Log files of 102 MB, 256 MB, 512 MB, and 1024 MB, generated from log data received from various devices in the network, are input into the OC and simple event correlator (SEC) for applying correlation rules. The results indicate that OC is 21 times faster than SEC in real-time response and 2.5 times more efficient in execution time. Furthermore, OC can detect multi-layered attacks successfully.

Hybrid quantum architecture for smart city security

Currently and in the near future, Smart Cities are vital to enhance urban living, address resource challenges, optimize infrastructure, and harness technology for sustainability, efficiency, and improved quality of life in rapidly urbanizing environments. Owing to the high usage of networks, sensors, and connected devices, Smart Cities generate a massive amount of data. Therefore, Smart City security concerns encompass data privacy, Internet-of-Things (IoT) vulnerabilities, cyber threats, and urban infrastructure risks, requiring robust solutions to safeguard digital assets, citizens, and critical services. Some solutions include robust cybersecurity measures, data encryption, Artificial Intelligence (AI)-driven threat detection, public–private partnerships, standardized security protocols, and community engagement to foster a resilient and secure smart city ecosystem. For example, Security Information and Event Management (SIEM) helps in real-time monitoring, threat detection, and incident response by aggregating and analyzing security data. To this end, no integrated systems are operating in this context. In this paper, we propose a Hybrid Quantum-Classical Architecture for bolstering Smart City security that exploits Quantum Machine Learning (QML) and SIEM to provide security based on Quantum Artificial Intelligence and patterns/rules. The validity of the hybrid quantum-classical architecture was proven by conducting experiments and a comparison of the QML algorithms with state-of-the-art AI algorithms. We also provide a proof of concept dashboard for the proposed architecture.

Data-Driven Framework for Cloud Storage Security Optimization: Leveraging Predictive Analytics and Machine Learning to Enhance Threat Detection and Incident Response

As cloud storage adoption accelerates, securing sensitive data against evolving threats, including Advanced Persistent Threats (APTs), Zero-Day Exploits, and Insider Threats, has become paramount. This research introduces a data-driven framework that harnesses predictive analytics, machine learning (ML), and deep learning (DL) techniques to fortify threat detection and incident response in cloud storage environments. By integrating real-time monitoring via Security Information and Event Management (SIEM) systems, anomaly detection using Convolutional Neural Networks (CNN) and Recurrent Neural Networks (RNN), and predictive modeling through Graph-Based Anomaly Detection (GBAD), our framework identifies potential security risks and optimizes countermeasures. Leveraging ML algorithms, such as Random Forest and Support Vector Machines (SVM), our approach analyzes historical incident data, user behavior, and system logs to predict and prevent attacks. Key benefits include proactive security measures, reduced response times via Security Orchestration, Automation, and Response (SOAR), and minimized data breaches through Containerization (Docker) and Serverless Computing (AWS Lambda). This research advances the development of intelligent cloud storage security solutions, ensuring robust protection for sensitive data in cloud-based infrastructure, compliant with PCI-DSS, HIPAA, GDPR, NIST Cybersecurity Framework, and ISO 27001.

Analysing Multidimensional Strategies for Cyber Threat Detection in Security Monitoring

The escalating risk of cyber threats requires continuous advances in security monitoring techniques. This survey paper provides a comprehensive overview of recent research into novel methods for cyber threat detection, encompassing diverse approaches such as machine learning, artificial intelligence, behavioral analysis and anomaly detection. Machine learning plays a central role in cyber threat detection, highlighting the effectiveness of deep neural networks in identifying evolving threats. Their adaptability to changing attack patterns is emphasized, underlining their importance for real-time security monitoring. In parallel, ensemble learning is explored, combining multiple models to improve overall detection accuracy and create a robust defense against a spectrum of cyber threats. The literature reviewed highlights the importance of behavioral analysis, with a novel approach that integrates user behaviour profiling with anomaly detection. This has proven effective in identifying suspicious activity within a network, particularly insider threats and stealthy attacks. Another behavioral framework using User and Entity Behavior Analytics (UEBA) is presented for enhanced anomaly detection, highlighting the importance of context-aware monitoring in improving threat detection accuracy. Collaborative defense mechanisms emerge as a major focus of the research papers reviewed, exploring the potential of sharing threat information between organisations to enhance collective security monitoring. Their findings underscore the importance of a collaborative approach to staying ahead of rapidly evolving cyber threats. Some types of cyber-attacks are also analysed in the context of a security operations centre (SOC) monitoring environment using a security information and event management (SIEM) tool - Splunk. In conclusion, this survey paper synthesizes recent advances in cyber threat detection methods in security monitoring that integrate machine learning, behavioral analysis, and collaborative defense strategies. As cyber threats continue to evolve, these novel methods provide valuable insights for researchers, practitioners, and organisations seeking to strengthen their cybersecurity defenses. This concise overview emphasises the multi-dimensional approach required to secure digital ecosystems, providing a concise yet comprehensive guide to modern cyber threat detection strategies.

An Incident Management System Design to Protect Critical Infrastructures from Cyber Attacks

In recent years, there has been a noticeable trend toward targeted threats to information security, where companies are now leveraging vulnerabilities and risks associated with widely used services in order to generate financial gain. Additionally, they implement numerous precautions and consistently carry out their tasks. One item that requires precautionary measures is the network devices utilized. Network devices in computer networks possess the capability to log events. These logs enable the identification of security events on the network and facilitate the implementation of precautionary measures. Various security measures can be implemented to handle such data. One of these measures is Security Information and Event Management (SIEM). It is a system that gathers and analyzes data from networks and security devices. SIEM is a technique employed to consolidate critical information within a cohesive structure. It allows for the correlation of events from different security devices, thereby improving the monitoring capabilities of cybersecurity operations centers. This study extensively covers the critical infrastructure-SIEM relationship, current studies, critical infrastructure, cyber security policies, and SIEM. Our system design was developed using the UNSW\_NB15 dataset, a widely recognized dataset in cybersecurity due to its comprehensive and realistic representation of cyber threats. This dataset consists of data obtained from network traffic, various attack activities, and real-life modern normal scenarios, making it particularly relevant to our study. With the studies, a total of 10 different categories were analyzed, with the category consisting of nine types of attacks, namely Analysis, Backdoor, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms and Normal activities. The study is divided into two as the basic structure. The first step was carried out on Google Collaboratory, and then some experimental studies were carried out in Weka. Classifications were made using several methods, including Logistic Regression (LR), Extra Trees (XT), Support Vector Machines (SVM), Random Forest (RF), and Decision Trees (DT). These methods were chosen for their proven effectiveness in similar studies. In the application developed with Google Colabratory, we achieved 98.62\% in Random Forest, 99.10\% in Decision Trees, 98.87\% in Logistic Regression, 95.13\% success in Extra Trees and 99.12\% success in Support Vector Machines. As a result of the studies and experiments carried out in Weka, we achieved 92.05\% in Random Forest, 100\% in Decision Trees, 100\% in k-Nearest Neighbours, 100\% in J48, 99.19\% in Naive-Bayes and 99.35\% in BayesNet achievements.

A comprehensive investigation of clustering algorithms for User and Entity Behavior Analytics.

Government agencies are now encouraging industries to enhance their security systems to detect and respond proactively to cybersecurity incidents. Consequently, equipping with a security operation center that combines the analytical capabilities of human experts with systems based on Machine Learning (ML) plays a critical role. In this setting, Security Information and Event Management (SIEM) platforms can effectively handle network-related events to trigger cybersecurity alerts. Furthermore, a SIEM may include a User and Entity Behavior Analytics (UEBA) engine that examines the behavior of both users and devices, or entities, within a corporate network. In recent literature, several contributions have employed ML algorithms for UEBA, especially those based on the unsupervised learning paradigm, because anomalous behaviors are usually not known in advance. However, to shorten the gap between research advances and practice, it is necessary to comprehensively analyze the effectiveness of these methodologies. This paper proposes a thorough investigation of traditional and emerging clustering algorithms for UEBA, considering multiple application contexts, i.e., different user-entity interaction scenarios. Our study involves three datasets sourced from the existing literature and fifteen clustering algorithms. Among the compared techniques, HDBSCAN and DenMune showed promising performance on the state-of-the-art CERT behavior-related dataset, producing groups with a density very close to the number of users.

Cybersecurity on a budget: Evaluating security and performance of open-source SIEM solutions for SMEs.

The proliferation of cyber threats necessitates robust security measures to safeguard critical assets and data in today's evolving digital landscape. Small and Medium Enterprises (SMEs), which are the backbone of the global economy are particularly vulnerable to these threats due to inadequate protection for critical and sensitive information, budgetary constraints, and lack of cybersecurity expertise and personnel. Security Information and Event Management (SIEM) systems have emerged as pivotal tools for monitoring, detecting, and responding to security incidents. While proprietary SIEM solutions have historically dominated the market, open-source SIEM systems have gained prominence for their accessibility and cost-effectiveness for SMEs. This article presents a comprehensive study focusing on the evaluation of open-source SIEM systems. The research investigates the capabilities of these open-source solutions in addressing modern security challenges and compliance with regulatory requirements. Performance aspects are explored through empirical testing in simulated enterprise-grade SME network environments to assess resource utilization, and real-time data processing capabilities. By providing a rigorous assessment of the security and performance features of open-source SIEM systems, this research offers valuable insights to cybersecurity practitioners, organizations seeking cost-effective security solutions, and the broader academic community. The findings shed light on the strengths and limitations of these systems, aiding decision-makers in selecting the most suitable SIEM solution for their specific requirements while enhancing the cybersecurity posture of SMEs.

Enhancing Cyber Resilience: Convergence of SIEM, SOAR, and AI in 2024

Purpose: The study aims to examine the synergistic effects of integrating Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and Artificial Intelligence (AI) technologies in enhancing cybersecurity frameworks. It explores how this combination can lead to a transformative era in cybersecurity, focusing on the improved efficacy of threat management and incident response.
 Methodology: An analytical approach was used to investigate the integration trends between SIEM and SOAR technologies, underpinned by advancements in AI. This method emphasizes accelerated incident detection and response, enriched threat intelligence collaboration, and fortified security strategies.
 Findings: The fusion of SIEM, SOAR, and AI technologies has led to a paradigm shift in cybersecurity, offering unparalleled efficiency in threat management and a significant reduction in the impacts of cyber incidents on entities. It highlights the accelerated detection and response to incidents and the enhancement of threat intelligence collaboration and security strategies.
 Unique Contribution to Theory, Practice, and Policy: This study contributes to the field by presenting invaluable insights for cybersecurity practitioners and entities aiming to strengthen their defenses against an evolving digital threat landscape. It advocates for a proactive orchestration of security measures, underlining the strategic implications of the SIEM-SOAR-AI triad for future cybersecurity endeavors. Recommendations are provided for entities to adopt this integrated approach to enhance their cybersecurity frameworks effectively.

On the Benefits of Vulnerability Data Consolidation in Application Security

This research aims to build upon a conceptual idea of consolidating all application security vulnerability data from monitoring, detection, and discovery tools into a physical system that allows for convergence of observation and response to an event that is a threat. Multiple application security testing and monitoring tools are deployed at different layers of an application architecture and capture activities that occur at that layer. This multi-layer data capture is disconnected without any analysis of data lineage from the externally exposed web attack surface to deep down into the application and data layers. It is only through this data consolidation can one provide a reliable statistical analysis of correlating multiple vulnerability information and synthesize an attack pattern and predict possible events accurately. The benefits of such a system are discussed in this paper that includes how one can organize the data, identifying temporal and spatial correlation of events, focusing on specific web requests that point to a specific vulnerability, and formulating a fast response to such events. Advantages of integrating with Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR/XSOAR), Extended Detection Response (XDR) are briefly discussed. The analysis can be further used to develop a predictive system using deep learning (DL) techniques using correlation of application security vulnerability information.

A Proposed Approach to Integrate Application Security Vulnerability Data with Incidence Response Systems

This paper has proposed a method to develop an attack tree, from application vulnerability data discovered through tests and scans and correlation analysis using incoming transaction requests monitored by a Web Application Firewall (WAF) tool. The attack tree shows multiple pathways for an attack to shape through vulnerability linkages and a deeper analysis of the Common Weakness Enumeration (CWE) and Common Vulnerability Exposure (CVE) mapping to individual vulnerabilities. By further relating to a parent, peer, or child CWE (including CWEs that follow another CWE and in some cases precede other CWEs) will provide more insight into the attack patterns. These patterns will reveal a multi-vulnerability, multi-application attack pattern which will be hard to visualize without data consolidation and correlation analysis. The correlation analysis tied to the test and scan data supports a vulnerability lineage starting from incoming requests to individual vulnerabilities found in the code that traces a possible attack path. This solution, if automated, can provide threat alerts and immediate focus on vulnerabilities that need to be remedied as a priority. SOAR (Security Orchestration, Automation, and Response), XSOAR (Extended Security Orchestration, Automation, and Response), SIEM (Security Information and Event Management), and XDR (Extended Detection and Response) are more constructed to suit networks, infrastructure and devices, and sensors; not meant for application security vulnerability information as collected. So, this paper makes a special case that must be made for integration of application security information as part of threat intelligence, and threat and incident response systems.

Implementation of Security Information & Event Management (SIEM) Wazuh with Active Response and Telegram Notification for Mitigating Brute Force Attacks on The GT-I2TI USAKTI Information System

In an era of widespread information system usage across various sectors, digital threats to organizations have become increasingly significant. These threats have the potential to disrupt operations and result in substantial financial losses. One enduring threat is brute force attacks, which exploit human tendencies to use easily remembered passwords. By utilizing The Security Lifecycle Methodology, this research aims to identify an efficient and cost-effective solution to enhance information system security and continuously evaluate the implemented solution rather than stop right after the policy or solution implementation. The study proposes the utilization of the open-source Security Information and Event Management (SIEM) platform, Wazuh. When combined with the Active Response feature, this platform not only detects security threats but also automatically takes mitigating actions against detected attacks. Additionally, the integration with the Telegram messaging application streamlines the SIEM monitoring process, making it more practical and efficient. After implementation, the testing phase confirms the effectiveness of the implemented solution as the Wazuh SIEM is able to detect 100% of brute force testing scenarios in multi- protocol attacks with an average of 80,51 seconds time required to detect brute force attacks with a 1-second interval between attack, 172,18 seconds for 10-seconds attack interval, and 434,58 seconds for 30-seconds attack interval. The active response can mitigate 100% of the detected brute force attack with only 0,51 seconds time required between detection and mitigation action taken. The implemented telegram integration successfully sends all the notifications on time to Telegram Chat by utilizing Telegram API.

From Detection to Prediction: AI-powered SIEM for Proactive Threat Hunting and Risk Mitigation

The evolution of cybersecurity has witnessed a transformative shift from reactive defense measures to proactive threat-hunting and risk-mitigation strategies. In response to the rapidly evolving threat landscape, the integration of Artificial Intelligence (AI) into Security Information and Event Management (SIEM) tools has emerged as a crucial solution. Historically, SIEMs primarily aggregated security data but struggled to analyze the vast, complex datasets effectively. The integration of AI, especially Machine Learning (ML) and Deep Learning (DL), revolutionized these systems. AI algorithms enable SIEMs to extract meaningful insights from massive datasets, allowing for the identification of subtle anomalies and hidden threats that may not be detected by traditional detection methods. This transition marks a fundamental shift from simple data aggregation to intelligent analysis, empowering SIEMs to move beyond detection towardproactive threat hunting. This paper highlights the role of AI in predicting threats, leveraging historical data to forecast potential risks, and continuously learning to adapt to evolving threat landscapes. It also explores the real-world use cases of AI-powered SIEMs in proactive threat hunting and risk mitigation.

Detection of Botnet in the loT Network

The ubiquity of Internet of Things (IoT) devices has prompted security concerns, particularly in the face of evolving botnet attacks. This paper investigates the impact of botnet attacks on IoT devices and proposes a network-based detection and prevention system employing signature and anomaly-based mechanisms. Notably, our methodology extends beyond traditional detection, focusing on proactively impeding bot creation. Leveraging a Linux-based distributed system, Security Information and Event Management (SIEM) tools, and custom rules, our approach encompasses distinct phases Preprocessing, Network Security Monitoring, Rule-based IDS System, and Analysis. Experimental results with diverse PCAP files demonstrate the efficacy of custom rules, significantly enhancing alert counts for various security aspects, including network trojan detection and privacy violations. The significant finding is the substantial increase in alert counts after the integration of custom rules, exemplified in the 1.1 GB PCAP file scenario. Network trojan detection surged from 585 to 988, emphasizing the heightened efficacy of rule-based measures. Privacy breaches and bad traffic alerts also experienced significant increments, showcasing the system’s improved sensitivity and responsiveness. This finding reinforces the pivotal role of custom rules in fortifying IoT network security comprehensively.

Stochastic forecasting of variable small data as a basis for analyzing an early stage of a cyber epidemic

Security Information and Event Management (SIEM) technologies play an important role in the architecture of modern cyber protection tools. One of the main scenarios for the use of SIEM is the detection of attacks on protected information infrastructure. Consorting that ISO 27001, NIST SP 800-61, and NIST SP 800-83 standards objectively do not keep up with the evolution of cyber threats, research aimed at forecasting the development of cyber epidemics is relevant. The article proposes a stochastic concept of describing variable small data on the Shannon entropy basis. The core of the concept is the description of small data by linear differential equations with stochastic characteristic parameters. The practical value of the proposed concept is embodied in the method of forecasting the development of a cyber epidemic at an early stage (in conditions of a lack of empirical information). In the context of the research object, the stochastic characteristic parameters of the model are the generation rate, the death rate, and the independent coefficient of variability of the measurement of the initial parameter of the research object. Analytical expressions for estimating the probability distribution densities of these characteristic parameters are proposed. It is assumed that these stochastic parameters of the model are imposed on the intervals, which allows for manipulation of the nature and type of the corresponding functions of the probability distribution densities. The task of finding optimal functions of the probability distribution densities of the characteristic parameters of the model with maximum entropy is formulated. The proposed method allows for generating sets of trajectories of values of characteristic parameters with optimal functions of the probability distribution densities. The example demonstrates both the flexibility and reliability of the proposed concept and method in comparison with the concepts of forecasting numerical series implemented in the base of Matlab functions.

Mobile Security Operation Centre (mSOC)

Attacks on the internet are becoming increasingly threatening. For naïve home users, who are poorly protected, there is always an imminent danger of getting cyber attacked. 
 This paper is aimed to design and build an IoT-based Network Security device that would run as an access point for users to connect to the Internet in a home setting. The paper discusses a standalone perimeter security solution with Incident Response (IR) life cycle management and controls through an IoT device – Raspberry PI. Enterprise-level features such as Next Generation Firewall (NGFW), Network Intrusion Detection System (NIDS), Domain Control for Ad/Spam blocking, Security Information and Event Management (SIEM) for Log Co-ran System on Chip (SoC), which can be installed anywhere and carried for mobile operations. Hence, the name, Mobile Security Operation Centre (mSOC).
 This solution intends to protect the user when browsing the internet and blocking or providing visibility to the malicious connections made to or from users. The mSOC can filter domains based on whitelist/blacklist and Regex Pattern. It can also identify the domains that are blocked or allowed. It also provides visibility to traffic, application statistics, and IP reputation. IP reputation and Malicious Domains then can act as input to the iptables for L3/L4 blocking. A Software User Interface is developed to integrate and manage multiple Open-Sourced applications like dnsmasq/ elk/ graylog/ SQlite3/ Iptables/ adminlte as a single product that could serve as a complete security solution for a home or Small Medium Business (SMB). Thus, the proposed solution secures naïve users from security exploitations.