Application Self-Learning System Event Correlation Information Security Based on Fuzzy Logic Automation in Management Systems Information Security
DOI:
https://doi.org/10.14529/ctcr160116Keywords:
fuzzy logic, SIEM-system self-learning system, information security management systemAbstract
Currently, the most widely used on the market SIEM-systems using the signature event correlation methods of information security, which is due, ease of implementation and flexibility in configuring and further exploitation. This system, built on this principle, are not able to adapt to the rapidly changing IT-landscape by virtue of predetermined information security incidents to which they can respond. The disadvantages of such systems include a large number of false positives and the relative complexity of the configuration and implementation. The article discusses how to use fuzzy logic to construct a self-learning system of information security event correlation as an alternative to the widespread signature methods. The article explains the scheme of the self-learning system event correlation and its advantages over signature-based correlation.
References
Miller, D.R. Security Information and Event Management (SIEM) implementation / D.R. Miller, S. Harris, S. Vandyke. – McGrawHill, 2011. – 464 с.
Рудинский, И.Д. Технология проектирования автоматизированных систем обработки информации и управления / И.Д. Рудинский. – Горячая линия-Телеком, 2014. – 304 с.
Жданов, А.А. Метод автономного адаптивного управления / А.А. Жданов // Известия академии наук. Теория и системы управления. – 1999. – № 5. – С. 125.
Zadeh, L.A. The Concept of a Linguistic Variable and its Application to Approximate Reasoning. Parts 1 and 2 / L.A. Zadeh. – Information Sciences, 1975. – 357 p.
