Our study differs from the others since it considers five separate feature (IP reputation, web reputation, malware destination access, botnet) and includes them into ML model.
📌 3 Key Takeaways
🎯
Objective & Hypothesis:Log files keep activity records of each process performed have an important place in terms of security.
📊
Key Findings & Data:Systems that provide infrastructure for applications such as network security mainly work on log management.
💡
Conclusion & Impact:Our study differs from the others since it considers five separate feature (IP reputation, web reputation, malware destination access, botnet) and includes them into ML model.
🔬Design:Modeling & Simulation
📍Scope:Comprehensive Sample
⚙️Variables:Log analysis · security management · alarm system
Abstract
Log files keep activity records of each process performed have an important place in terms of security. Systems that provide infrastructure for applications such as network security mainly work on log management. Recently, when the security mechanisms of popular applications are examined, it has been observed that they aim to strengthen their infrastructures with machine learning (ML) methods, but in some respects, they have shortcomings. In this study, we aim to develop an alarm and security reporting system using ML methods. Our study differs from the others since it considers five separate feature (IP reputation, web reputation, malware destination access, botnet) and includes them into ML model.
Miller, D. (2011). Security information and event management (SIEM) implementation. McGraw-Hill
AlSabbagh, B., & Kowalski, S. (2016, August). A Framework and Prototype for A Socio-Technical Security Information and Event Management System (ST-SIEM). In 2016 European Intelligence and Security Informatics Conference (EISIC) (pp. 192-195). IEEE
Deliang, C., Xing, L., & Qianli, Z. (2016, May). A comparative study on user characteristics of fixed and wireless network based on DHCP. In 2016 IEEE Information Technology, Networking, Electronic and Automation Control Conference (pp. 327-330). IEEE
Schleburg, M., Christiansen, L., Thornhill, N. F., & Fay, A. (2013). A combined analysis of plant connectivity and alarm logs to reduce the number of alerts in an automation system. Journal of process control, 23(6), 839-851
Ambre, A., & Shekokar, N. (2015). Insider threat detection using log analysis and event correlation. Procedia Computer Science, 45, 436-445
Li, T., & Yan, L. (2017, June). Siem based on big data analysis. In International Conference on Cloud Computing and Security (pp. 167-175). Springer, Cham.