The Operational Role of Security Information and Event Management Systems

Bhatt, Sandeep N.; Manadhata, Pratyusa K.; Zomlot, Loai

doi:10.1109/msp.2014.103

Cited by 144 publications

(76 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…For example, an analysis of 12 million events lasts about 70 s only. Taking into account the linearly growing execution time, such a performance allows to analyse about 15 billion events per day, which should be enough to analyse all available events even in large enterprises such as EMC or at least significantly increase the number of processed events for a Cyber Defense Center like HP has . Further, we believe that the main limitation – memory requirements of the SAP HANA database – could be elaborated.…”

Section: Performance Of Predictive Analysis Methodsmentioning

confidence: 99%

See 1 more Smart Citation

Evaluation of in‐memory storage engine for machine learning analysis of security events

Gawron

Jaeger

Cheng

et al. 2016

Concurrency and Computation

View full text Add to dashboard Cite

SUMMARYModern security information and event management systems should be capable to store and process high amount of events or log messages in different formats and from different sources. This requirement often prevents such systems from usage of computational heavy algorithms for security analysis. To deal with this issue, we built our system based on an in-memory database with an integrated machine learning library, namely, SAP HANA. Three approaches, that is, (1) deep normalisation of log messages, (2) storing data in the main memory and (3) running data analysis directly in the database, allow us to increase processing speed in such a way that machine learning analysis of security events becomes possible nearly in real time. Besides that, we developed a universal anomaly detection algorithm, which uses vector space model to represent and cluster textual log messages. Together with deep normalisation approach, this algorithm solves the problem of correlation for heterogenous security events containing many text fields. To prove our concepts, we measured the processing speed for the developed system on the data generated using Active Directory testbed, compared it with classical system architecture based on PostgreSQL database and showed the efficiency of our approach for high-speed analysis of security events.

show abstract

Section: Performance Of Predictive Analysis Methodsmentioning

confidence: 99%

“…To deal with this issue, Yen et al needed to apply data reduction and artificially reduce the number of events to be processed . The Cyber Defense Center of HP seems to have a similar problem: Bhatt et al report about 100 billion to 1 trillion security events per day, while only 3 billion of them could be processed .…”

Section: Introductionmentioning

confidence: 99%

Evaluation of in‐memory storage engine for machine learning analysis of security events

Gawron

Jaeger

Cheng

et al. 2016

Concurrency and Computation

View full text Add to dashboard Cite

show abstract

“…For example, an analysis of 12 million events lasts about 70 seconds only. Taking into account the linearly growing execution time, such a performance allows to analyse about 15 billion events per day, which should be enough to analyse all available events even in large enterprises such as EMC [19] or at least significantly increase the number of processed events for a Cyber Defense Center like HP has [20]. Further, we believe, that the main limitation -memory requirements of the SAP HANA database -could be elaborated.…”

Section: Performance Of Predictive Analysis Methodsmentioning

confidence: 99%

“…al. report about 100 billion to 1 trillion security events per day, while only 3 billion of them could be processed [20].…”

Section: Introductionmentioning

confidence: 99%

High-Speed Security Analytics Powered by In-Memory Machine Learning Engine

Gawron

Jaeger

Cheng

et al. 2015

2015 14th International Symposium on Parallel and Distributed Computing

View full text Add to dashboard Cite

Modern Security Information and Event Management systems should be capable to store and process high amount of events or log messages in different formats and from different sources. This requirement often prevents such systems from usage of computational-heavy algorithms for security analysis. To deal with this issue, we built our system based on an in-memory database with an integrated machine learning library, namely SAP HANA. Three approaches, i.e. (1) deep normalisation of log messages (2) storing data in the main memory and (3) running data analysis directly in the database, allow us to increase processing speed in such a way, that machine learning analysis of security events becomes possible nearly in real-time. To prove our concepts, we measured the processing speed for the developed system on the data generated using Active Directory testbed and showed the efficiency of our approach for high-speed analysis of security events.

show abstract

“…1 That article emphasized that SIEMs are responsible for collecting audit logs from all areas of an enterprise and presenting SOC analysts with only the most critical security events to act on.…”

mentioning

confidence: 99%

A Developer's Guide to Audit Logging

Margulies¹

2015

IEEE Secur. Privacy

View full text Add to dashboard Cite

The Operational Role of Security Information and Event Management Systems

Cited by 144 publications

References 7 publications

Evaluation of in‐memory storage engine for machine learning analysis of security events

Evaluation of in‐memory storage engine for machine learning analysis of security events

High-Speed Security Analytics Powered by In-Memory Machine Learning Engine

A Developer's Guide to Audit Logging

Contact Info

Product

Resources

About