革命性的SIEM安全:一个创新的关联引擎设计,用于多层攻击检测
Muhammad Sheeraz1, Muhammad Hanif Durad1, Muhammad Arsalan Paracha1
1Department of Computer and Information Sciences, Pakistan Institute of Engineering and Applied Sciences, Islamabad 45650, Pakistan.
Sensors (Basel, Switzerland)
|August 10, 2024
概括
优化对应器 (OC) 通过使用Hyperscan进行更快的日志分析来增强安全信息和事件管理 (SIEM) 系统. 这在工业4.0环境中改善了实时网络攻击的检测和缓解.
科学领域:
- 网络安全 网络安全
- 计算机科学 计算机科学
- 信息技术 信息技术 信息技术
背景情况:
- 工业4.0的进步增加了网络攻击的风险.
- 传统的安全系统与复杂的威胁作斗争.
- 安全信息和事件管理 (SIEM) 系统对于网络安全至关重要.
研究的目的:
- 为SIEM系统引入一个优化的相关系数 (OC).
- 提高SIEM的性能和检测能力.
- 为了解决传统SIEM相关引擎的局限性.
主要方法:
- 开发了一种新的相关引擎 (OC),取代了与Hyperscan.com匹配的regex.
- 实现并行日志数据扫描以提高效率.
- 使用各种日志文件大小 (102MB-1024MB) 对简单事件对应器 (SEC) 进行了 OC 测试.
主要成果:
- 与SEC相比,OC显示了21倍更快的实时响应.
- 在执行时间方面,OC的效率是执行时间的2.5倍.
- OC成功检测到多层次的网络攻击.
结论:
- 拟议的OC显著提高了SIEM系统的性能.
- 超扫描集成增强日志分析速度和准确性.
- OC提供了一种更有效的解决方案,用于检测先进的网络威胁.
相关概念视频
Correlation
11.7K
In statistics, two variables are said to be correlated if the values of one variable are associated with the other variable. Depending on the relationship between two variables, correlation can be of three types– positive correlation, negative correlation, and zero correlation.
Two variables, for example, a and b, are said to be positively correlated if both variables move in the same direction. In other words, a positive correlation exists between two variables, a and b, if:
Two variables, for example, a and b, are said to be positively correlated if both variables move in the same direction. In other words, a positive correlation exists between two variables, a and b, if:
11.7K
Multi-input and Multi-variable systems
105
Cruise control systems in cars are designed as multi-input systems to maintain a driver's desired speed while compensating for external disturbances such as changes in terrain. The block diagram for a cruise control system typically includes two main inputs: the desired speed set by the driver and any external disturbances, such as the incline of the road. By adjusting the engine throttle, the system maintains the vehicle's speed as close to the desired value as possible.
In the absence...
In the absence...
105
Correlations
32.7K
Correlation means that there is a relationship between two or more variables (such as ice cream consumption and crime), but this relationship does not necessarily imply cause and effect. When two variables are correlated, it simply means that as one variable changes, so does the other. We can measure correlation by calculating a statistic known as a correlation coefficient. A correlation coefficient is a number from -1 to +1 that indicates the strength and direction of the relationship between...
32.7K
Correlation and Regression
1.2K
In statistics, correlation describes the degree of association between two variables. In the subfield of linear regression, correlation is mathematically expressed by the correlation coefficient, which describes the strength and direction of the relationship between two variables. The coefficient is symbolically represented by 'r' and ranges from -1 to +1. A positive value indicates a positive correlation where the two variables move in the same direction. A negative value suggests a...
1.2K
2D NMR: Overview of Homonuclear Correlation Techniques
174
Homonuclear correlation spectroscopy (COSY) is a powerful technique used in Nuclear Magnetic Resonance (NMR) spectroscopy to study the correlations between nuclei of the same type within a molecule. It provides information about scalar couplings between adjacent nuclei, which helps determine connectivity and structural information. There are several COSY variants, each with its unique strengths and experimental parameters.
COSY90 is the standard two-dimensional (2D) COSY experiment that...
COSY90 is the standard two-dimensional (2D) COSY experiment that...
174
Correlation of Experimental Data
227
Dimensional analysis simplifies complex physical problems and guides experimental investigations, but it does not provide complete solutions. It identifies the dimensionless groups that influence a phenomenon, but experimental data is needed to establish the specific relationships and validate theoretical predictions.
For example, a spherical particle moving through a viscous fluid experiences drag. Dimensional analysis shows that the drag force depends on the particle's diameter, velocity,...
For example, a spherical particle moving through a viscous fluid experiences drag. Dimensional analysis shows that the drag force depends on the particle's diameter, velocity,...
227


