4.6 Article

Effective Security Monitoring Using Efficient SIEM Architecture

出版社

KOREA INFORMATION PROCESSING SOC
DOI: 10.22967/HCIS.2023.13.017

关键词

Security Information and Event Management; Security Operation Center; Data Aggregation; Log Formats; Data Normalization; Event Correlation; Correlation Engine; Big Data

向作者/读者索取更多资源

The internet's advancements and benefits have made it essential for organizations, but security threats are on the rise. Monitoring security and utilizing SIEM and SOAR systems as part of a SOC are crucial for organizations to protect their IT infrastructure and make informed decisions.
The unprecedented advances and myriad benefits of the internet have made it indispensable for almost every organization. With its growing popularity and widespread use, the problem of security threats has emerged to the forefront, while attacks are constantly on the rise. Therefore, an organization must continuously monitor its security status to take immediate remedial measures. Security information and event management (SIEM) systems in tandem with security orchestration, automation, and response (SOAR) systems are an integral part of a security operation center (SOC) because this not only further helps organizations gain a holistic view of their security status but also protects their IT infrastructure. In this research paper, we will provide discussions on the latest and most advanced and widely used SIEM systems. These include both open-source and proprietary solutions. However, as documented in literature, no comprehensive SIEM system architecture is available. The main contribution of this research work is that we have proposed a comprehensive, well-defined and modular architecture of the SIEM system. Each module has been discussed in detail with reference to its input parameters, processing, and output details. This modular approach will help developers extend the functionality of the SIEM system without compromising the overall performance and integration issues, while also helping end users make better decisions to select a SIEM system.

作者

我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。

评论

主要评分

4.6
评分不足

次要评分

新颖性
-
重要性
-
科学严谨性
-
评价这篇论文

推荐

暂无数据
暂无数据