Closing the loop of SIEM analysis to Secure Critical Infrastructures

2014/05/12 by Alessia Garofalo, Cesario Di Sarno, Garofalo, Alessia +7
Computer Science · #Business #Closing (real estate) #Computer science #Computer security #Cryptography and Security (cs.CR) #Event (particle physics) #FOS: Computer and information sciences #Network Packet Processing and Optimization #Network Security and Intrusion Detection #Software System Performance and Reliability #System administrator #cs.CR

paper · pdf · doi:10.48550/arxiv.1405.2995

EDCC-2014, BIG4CIP-2014, Security Information and Event Management, Decision Support System, Hydroelectric Dam

arxiv created 2014/05/12 · openalex publication_date 2014/05/12 · arxiv updated 2014/05/14 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Critical Infrastructure Protection is one of the main challenges of last years. Security Information and Event Management (SIEM) systems are widely used for coping with this challenge. However, they currently present several limitations that have to be overcome. In this paper we propose an enhanced SIEM system in which we have introduced novel components to i) enable multiple layer data analysis; ii) resolve conflicts among security policies, and discover unauthorized data paths in such a way to be able to reconfigure network devices. Furthermore, the system is enriched by a Resilient Event Storage that ensures integrity and unforgeability of events stored.

Citations

• A scaling method for priorities in hierarchical structures

Related

• Critical Infrastructure Protection: having SIEM technology cope with network heterogeneity
• You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks
• Big Data in Critical Infrastructures Security Monitoring: Challenges and Opportunities
• Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection
• Enhancing SCADA Security: Developing a Host-Based Intrusion Detection System to Safeguard Against Cyberattacks