New Types of Alert Correlation for Security Information and Event Management Systems

摘要: Current Security Information and Event Management systems (SIEMs) constitute the central platform of modern security operations centers. They gather events from multiple sensors (intrusion detection systems, anti-virus, firewalls, etc.), correlate these events, deliver synthetic views alerts for threat handling reporting. However, as number incidents, thus diversity received by SIEMs increases, need appropriate treatment has become essential. Alert correlation been proposed in order to alleviate this problem. alert techniques provide a better description detected incident concise view generated alerts, reducing their volume processing time. Although such support administrators huge they remain limited, since solutions do not information about attacker's behavior defender's capability reacting attacks. In paper, we propose two novel approaches. The first is based on policy enforcement defender models; second indicators. We therefore enrich current state art with complementary