Dynamical Calculation of Security Metrics for Countermeasure Selection in Computer Networks

Security Information and Event Management (SIEM) systems collect security information from multiple input systems, with a view to correlating and interpreting events so as to conduct security analysis and inference. Our analysis of large SIEM event sets has shown that in many instances the source events also contain personal information resulting from activities performed by users. The treatment of privacy in such ‘meta-systems’ is a challenging and, as yet, largely unaddressed consideration in privacy debates. This paper uses the 2012 EU Draft Data Protection Regulation as a basis to develop a view of its implications for SIEMs and other meta-systems. Providers of SIEM services have an obligation to ensure that their ‘meta-systems’ adhere to the same requirements as other systems, and the complexity can be compounded if the SIEM is not located in the same country as the originating events. Recommendations for role clarification, notification requirements, anonymisation and data protection officer oversight activities are presented – with respect to requirements of the associated privacy specifications. By adhering to these privacy specifications, security objectives can be achieved while ensuring that the rights of individuals and obligations, in terms of data privacy requirements, are met even when centralised security events and other types of meta-data, are collected.KeywordsSIEMPrivacyData protectionEuropean UnionRegulationDirective

The object of the research in the chapter is the decision-making processes in special security information and event management (SIEM) systems designed for (near) real-time analysis of security threats to modern cyber-physical systems. Some mathematical methods for constructing a membership function as applied to decision-making problems within the framework of fuzzy management of security information and events of cyber-physical systems are studied. The values of the membership function are determined for the decision-making problems on whether a particular computer attack belongs to a fuzzy set of dangerous attacks (a set of attacks of a high level of danger). We consider fuzzy algorithms for solving this problem using a variant of constructing membership functions according to a probabilistic scheme and a method based on the representation of membership functions as functions of the probability density of clear random boundaries between terms of a linguistic variable. At the same time, both the method of constructing membership functions based on the analysis of probability density functions and the method using a simple probabilistic scheme, do not have high mathematical and computational complexity but allow taking into account the uncertainty (fuzziness) of the observed and controlled security parameters, which provides an increase in the reliability of control for security information and events within the framework of security fuzzy management for systems of this class.KeywordsCyber-physical systemSecurity information and event management systemMembership functionFuzzy controlProbabilityComputer attackSecurity parametersThreats

Continuously striving for cyberthreat awareness is an essential task to secure an IT infrastructure. Analysts must guarantee access to information on the most up-to-date cybersecurity events and threats. This monitoring process is often the job of a security information and event management system, which relies on the timeliness and relevance of its feeds. There has been growing interest in exploiting open source intelligence for this purpose, mainly due to its timeliness and volume. Social media sites such as Twitter, are capable of aggregating numerous cybersecurity-related sources and act as a stream of information that can be used to feed a cyberthreat intelligence platform. In this paper, we present a multi-task learning approach combining two Natural Language Processing tasks for cyberthreat intelligence. Our pipeline is capable of reading a stream of tweets from a set of Twitter accounts and, through a shared deep neural network architecture, simultaneously identify relevant cybersecurity-related content and extract indicators of compromise therein. We show that in comparison to the traditional independent tasks baseline, one of the tasks achieves a slight F1 score improvement, while the other task is able to maintain its performance. Thus, the proposed approach greatly simplifies the pipeline and the requirements for data and online model adaptation over time, without sacrificing functional performance.

The topic of cybersecurity is becoming increasingly important as the number of cyberattacks continues to grow; it is no longer just a matter of protecting, but rather of detecting cyberattacks at an early stage and responding accordingly.Detecting cyberattacks in organisations is an increasingly difficult task, since the ability of malware to hide from Anti-Virus systems has massively improved.Therefore, more sophisticated security measures are required, to protect complex information systems from cyberthreats.One of the state-of-the-art solutions is a Security Information and Event Management (SIEM) system, which collects all security related information and events on a central location.Thus, it is possible to correlate and better analyse security-related events, detect, and defend sophisticated threats.The deployment of a SIEM system (SIEMS) is a process where all devices in the network need to be registered and integrated.There is no generic model for the evaluation, deployment, and operation of a sufficient SIEMS that can be applied independently of the dedicated vendor.Usually, vendors provide deployment guides for their SIEMS; however, these are product-specific and not scientifically evaluated.Applying Design Science as methodological approach, the goal of this research was to develop and scientifically validate a generic model called EDO4SIEM for the vendor-neutral evaluation, deployment, and operation of a SIEMS in organisations.As desire for future research, the model should be applied in various organisations to confirm its applicability and to further develop it.

Implementation of a Security Information and Event Management System with Alert Automation to Strengthen Cybersecurity

Threat actors can be persistent, motivated and agile, and leverage a\ndiversified and extensive set of tactics and techniques to attain their goals.\nIn response to that, defenders establish threat intelligence programs to stay\nthreat-informed and lower risk. Actionable threat intelligence is integrated\ninto security information and event management systems (SIEM) or is accessed\nvia more dedicated tools like threat intelligence platforms. A threat\nintelligence platform gives access to contextual threat information by\naggregating, processing, correlating, and analyzing real-time data and\ninformation from multiple sources, and in many cases, it provides centralized\nanalysis and reporting of an organization's security events. Sysmon logs is a\ndata source that has received considerable attention for endpoint visibility.\nApproaches for threat detection using Sysmon have been proposed, mainly\nfocusing on search engine technologies like NoSQL database systems. This paper\ndemonstrates one of the many use cases of Sysmon and cyber threat intelligence.\nIn particular, we present a threat assessment system that relies on a cyber\nthreat intelligence ontology to automatically classify executed software into\ndifferent threat levels by analyzing Sysmon log streams. The presented system\nand approach augments cyber defensive capabilities through situational\nawareness, prediction, and automated courses of action.\n

In this paper we present CloudWall, a Cloud-enabled Resilience Framework specially tailored for the needs of the healthcare IT infrastructures. This framework will increase the
\ncapability of these infrastructures to prevent and react to cyber attacks. Starting from a risk analysis model based on multi-layer networks, CloudWall will allow to design and implement infrastructure deployments which are more resilient to cyber threats, and specially to malware spread, enforcing good practices in critical infrastructure IT design, such as isolated attack paths and hardware/software diversity in component deployment. The same risk analysis model will help to enhance threat detection using state-of-the-art technologies, like Security Information and Event Management Systems (SIEM). Finally, by deploying components and network elements in a virtualized private-cloud infrastructure when possible, it will leverage recent advances in container-based computing and network function virtualization (NFV) to allow the infrastructure (including both computation and networking assets) to reconfigure itself in the event of a
\nsecurity incident so that the risk of further damage is mitigated.

The relevance of the study is due to the need for effective protection of information systems in the face of ever-growing cyber threats. In the modern digital world, where cyberattacks are becoming increasingly complex and widespread, the use of artificial intelligence in cybersecurity is extremely relevant. The problem of cybersecurity is becoming increasingly important and conducting relevant research is becoming a necessary aspect of ensuring security in the digital space.In this context, we propose an article that examines the role of artificial intelligence, innovations, challenges, and prospects of its development in the sphere of cybersecurity. Additionally, it explores the utilization of artificial intelligence for automating processes of detecting, analysing, and responding to cyber threats, and its practical significance for enhancing security levels in the digital space and the effectiveness of cyber threat protection. The main approaches for this study are trend analysis and expert assessments, which allow for a comprehensive review of the directions of artificial intelligence development in the field of cybersecurity, the benefits and challenges of its implementation, as well as potential opportunities and threats to information security. The article discusses advanced security information and event management systems designed to collect, analyse and respond to cyber threats and other systems aimed at specific aspects ofprotection and expanding automation capabilities to improve the security level of information systems. The materials of the article are of theoretical value for further scientific research on the use of artificial intelligence in the sphere of cybersecurity and reflect important features of its influence on this area. This research can contribute not only to deepening the understanding of the theoretical aspects of the use of artificial intelligence in cybersecurity but also to identifying specific practical applications and innovations that will help improve protection against cyber threats in the future.

The article examines an applied approach to improving the effectiveness of information security incident detection in database management systems using PostgreSQL as a case study and the industrial security information and event management system MaxPatrol SIEM. The relevance of the problem is substantiated in the context of increasing attack complexity and growing volumes of logged data, which complicate the identification of significant events and the formation of a coherent incident context. The methodology for assessing information security threats developed by the Federal Service for Technical and Export Control of Russia (FSTEC) is used as a methodological basis, making it possible to correlate observable log features with threat implementation techniques. The study includes a two-stage selection of relevant threat techniques, an analysis of the correspondence between built-in MaxPatrol SIEM correlation rules and the selected attack scenarios, and the identification of detection gaps. It is shown that the default rule set provides limited coverage of techniques and is mainly focused on administrative operations and typical authentication scenarios. To address the identified gaps, a set of custom correlation rules was developed, implementing detection based on characteristic SQL constructs, sequences of execution errors, and access to sensitive objects. The developed rules were validated and successfully deployed, resulting in full coverage of the selected threat techniques without changes to logging configuration or the use of external analytical modules. The obtained results confirm the practical applicability of the proposed approach for maintaining SIEM solutions and adapting them to specific event sources.

The article justifies the imperatives of applying the situational approach to information security management (ISM). We modified the model of the Information Security Management System (ISMS), which is the basis of ISO/IEC 27005: 2011: we added the “Decision Making” stage after the “Determining the main criteria” step. The solution is to choose an approach to proccesing information security risks — their assessment, impact and taking — based on certain criteria. Using the developed algorithm, we implemented a cognitive software module of the information system management (ISM) in an educational institution. The use of the cognitive software module has significantly reduced the labor costs of specialists in the Information Security (IS) Department, including automation of the reporting procedures. The application of the situational approach allowed us to integrate a person into the automated system to ensure the cybersecurity of the educational sector.

Attack graphs enable computation of important network security metrics by revealing potential attack paths an adversary could use to gain control of network assets. This paper presents GARNET (Graphical Attack graph and Reachability Network Evaluation Tool), an interactive visualization tool that facilitates attack graph analysis. It provides a simplified view of critical steps that can be taken by an attacker and of host-to-host network reachability that enables these exploits. It allows users to perform what-if experiments including adding new zero-day attacks, following recommendations to patch software vulnerabilities, and changing the attacker starting location to analyze external and internal attackers. Users can also compute and view metrics of assets captured versus attacker effort to compare the security of complex networks. For adversaries with three skill levels, it is possible to create graphs of assets captured versus attacker steps and the number of unique exploits required. GARNET is implemented as a Java application and is built on top of an existing C++ engine that performs reachability and attack graph computations. An initial round of user evaluations described in this paper led to many changes that significantly enhance usability.

The analysis of security logs remains a major challenge for modern Security Information and Event Management (SIEM) systems due to insufficient standardization and diversity of log formats. While Artificial Intelligence (AI) offers great potential for automating monitoring, its use is limited by data sensitivity and a lack of annotated datasets. Augmentation can help generate realistic synthetic logs, providing broader opportunities for AI deployment. This article presents a framework for training language models to generate structured log variants, focusing on key metadata fields while maintaining syntactic consistency and semantic relevance. This framework increases data diversity, reduces the need for manual labeling, and facilitates the integration of AI into Security Operations Centers (SOCs), thereby enhancing operational efficiency. A heterogeneous corpus from 49 sources was cleaned, deduplicated, and transformed into semantically distinct entities. Two augmentation strategies were evaluated: Masked Language Modeling (MLM) and Next Word Prediction (NWP). Eight transformer-based models were finetuned and tested on simulated attack scenarios generated using the Atomic Red Team framework and compared with largescale models to assess accuracy and computational efficiency. The results demonstrate the potential of domain-specific language models for context-aware protocol augmentation, contributing to more efficient and automated security systems.

The increasing complexity and sophistication of cyber threats underscore the critical need for advanced threat detection mechanisms within Security Operations Centers (SOCs) to effectively mitigate risks and enhance cybersecurity resilience. This study enhances the capabilities of Wazuh, an open-source Security Information and Event Management (SIEM) system, by addressing its primary limitation: high false-positive rates in rule-based detection. We propose a hybrid approach that integrates machine learning (ML) techniques—specifically, Random Forest (RF) and DBSCAN—into Wazuh’s detection pipeline to improve both accuracy and operational efficiency. Experimental results show that RF achieves 97.2% accuracy, while DBSCAN yields 91.06% accuracy with a false-positive rate of 0.0821, significantly improving alert quality. Real-time deployment requirements are rigorously evaluated, with all models maintaining end-to-end processing latencies below 100 milliseconds and 95% of events processed within 500 milliseconds. Scalability testing confirms linear performance up to 500 events per second, with an average processing latency of 45 milliseconds under typical SOC workloads. This integration demonstrates a practical, resource-efficient solution for enhancing real-time threat detection in modern cybersecurity environments.

Application Programming Interfaces (APIs) have emerged as critical infrastructure components in modern digital services, yet traditional Web Application Firewalls (WAFs) prove inadequate against sophisticated attacks targeting business logic flaws and access control vulnerabilities. Behavioral threat detection platforms address these gaps by establishing baseline patterns of legitimate API usage and identifying deviations that signal potential threats such as credential stuffing, data scraping, and unauthorized data exfiltration. These systems leverage machine learning algorithms to analyze API traffic in real-time, generating contextual alerts that distinguish between benign anomalies and genuine security incidents. Advanced capabilities include automated discovery of undocumented or shadow APIs, classification of sensitive data flows, and implementation of tokenization strategies to protect information in transit. Integration with Security Information and Event Management (SIEM) systems enables orchestrated incident response, while continuous posture assessment ensures ongoing compliance with security policies. This comprehensive framework transforms API security from reactive rule-based filtering to proactive behavioral monitoring, significantly reducing the attack surface and enabling organizations to detect and respond to threats that would otherwise bypass conventional security controls.

The increasing migration of enterprise operations to Amazon Web Services (AWS) has amplified the need for robust, scalable, and intelligent cybersecurity solutions. Security Information and Event Management (SIEM) systems have become vital for detecting threats, correlating logs, and maintaining compliance in cloud environments. This systematic review explores the integration of SIEM tools within AWS-based infrastructures, focusing on their effectiveness in threat detection and log correlation. It examines leading SIEM solutions such as Splunk, IBM QRadar, Sumo Logic, and AWS-native services like Amazon GuardDuty, AWS CloudTrail, and AWS Security Hub. Emphasis is placed on key integration approaches, including API-based ingestion, agentless data capture, and real-time event streaming through AWS services like Kinesis and S3. The review critically analyzes studies published between 2018 and 2023, highlighting trends in the automation of log management, enrichment of security alerts through machine learning, and orchestration via Security Orchestration, Automation, and Response (SOAR) platforms. Challenges such as data normalization, scalability limitations, cross-service visibility, and compliance adherence in multi-account AWS architectures are discussed. The findings indicate that SIEM integration enhances threat detection efficiency by enabling proactive anomaly detection, facilitating rapid incident response, and improving forensic investigation capabilities. However, the review identifies gaps, particularly in cost optimization, handling high-velocity log streams, and adapting traditional SIEM models to dynamic, serverless AWS architectures. Best practices for successful SIEM deployment include leveraging AWS-native integrations, prioritizing event prioritization algorithms, applying continuous tuning, and aligning with security frameworks like NIST and CIS AWS Foundations Benchmark. Future research directions propose the development of AI-driven adaptive SIEM systems tailored for cloud-native environments, advanced correlation engines for serverless and containerized workloads, and strategies to optimize licensing and resource utilization. This systematic review provides cybersecurity practitioners, cloud architects, and researchers with a comprehensive understanding of SIEM integration complexities and evolving practices in AWS infrastructures, ultimately contributing to improved cloud security postures and operational resilience in the face of sophisticated cyber threats.