download0 view155
twitter facebook

공공누리This item is licensed Korea Open Government License

Title
Automated Verification Methodology of Security Events Based on Heuristic Analysis
Author(s)
송중석최상수김규일김석훈김수균이윤수
Publication Year
2015-10-01
Abstract
We present an automated verification methodology of the security events, that is, IDS alerts, based on heuristic analysis. The proposed verification methodology aims to automatically identify real cyberattacks from the security events and filter out false positive, so that the security analyst is able to conduct security monitoring and response more effectively. For the proposed verification methodology, we used the 1,528,730,667 security events that were obtained from Science and Technology Security Center (S&T-SEC). We then extracted the core security events that were caused by the real cyberattacks. Among the core security events, we selected the top 20 types of the security events in the number of the real attacks that they raised. By analyzing the top 20 types of the security events, we discovered essential elements and optional elements for using in the automated verification of the security events. The evaluation results showed that the proposed verification methodology could contribute to the reduction (about 67%) of the meaningless security events. Furthermore, we demonstrated that the proposed verification methodology contributed to the detection of 140 true negatives that were not identified by the security analyst and the total accuracy of the proposed verification methodology was 96.1%
Keyword
automated verification; security events; heuristic analysis
Journal Title
International Journal of Distributed Sensor Networks
Citation Volume
2015
ISSN
1550-1329
Files in This Item:
There are no files associated with this item.
Appears in Collections:
7. KISTI 연구성과 > 학술지 발표논문
URI
https://repository.kisti.re.kr/handle/10580/14466
http://www.ndsl.kr/ndsl/search/detail/article/articleSearchResultDetail.do?cn=NART76638050
Export
RIS (EndNote)
XLS (Excel)
XML

Browse