Automated Verification Methodology of Security Events Based on Heuristic Analysis
We present an automated verification methodology of the security events, that is, IDS alerts, based on heuristic analysis. The proposed verification methodology aims to automatically identify real cyberattacks from the security events and filter out false positive, so that the security analyst is ab...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Hindawi - SAGE Publishing
2015-09-01
|
| Series: | International Journal of Distributed Sensor Networks |
| Online Access: | https://doi.org/10.1155/2015/817918 |
| _version_ | 1797711144842952704 |
|---|---|
| author | Jungsuk Song Younsu Lee Kyuil Kim Seokhun Kim SooKyun Kim Sang-Soo Choi |
| author_facet | Jungsuk Song Younsu Lee Kyuil Kim Seokhun Kim SooKyun Kim Sang-Soo Choi |
| author_sort | Jungsuk Song |
| collection | DOAJ |
| description | We present an automated verification methodology of the security events, that is, IDS alerts, based on heuristic analysis. The proposed verification methodology aims to automatically identify real cyberattacks from the security events and filter out false positive, so that the security analyst is able to conduct security monitoring and response more effectively. For the proposed verification methodology, we used the 1,528,730,667 security events that were obtained from Science and Technology Security Center (S&T-SEC). We then extracted the core security events that were caused by the real cyberattacks. Among the core security events, we selected the top 20 types of the security events in the number of the real attacks that they raised. By analyzing the top 20 types of the security events, we discovered essential elements and optional elements for using in the automated verification of the security events. The evaluation results showed that the proposed verification methodology could contribute to the reduction (about 67%) of the meaningless security events. Furthermore, we demonstrated that the proposed verification methodology contributed to the detection of 140 true negatives that were not identified by the security analyst and the total accuracy of the proposed verification methodology was 96.1%. |
| first_indexed | 2024-03-12T07:02:44Z |
| format | Article |
| id | doaj.art-fb072c08777748b882d44d07fd51aca0 |
| institution | Directory Open Access Journal |
| issn | 1550-1477 |
| language | English |
| last_indexed | 2024-03-12T07:02:44Z |
| publishDate | 2015-09-01 |
| publisher | Hindawi - SAGE Publishing |
| record_format | Article |
| series | International Journal of Distributed Sensor Networks |
| spelling | doaj.art-fb072c08777748b882d44d07fd51aca02023-09-02T23:41:23ZengHindawi - SAGE PublishingInternational Journal of Distributed Sensor Networks1550-14772015-09-011110.1155/2015/817918817918Automated Verification Methodology of Security Events Based on Heuristic AnalysisJungsuk Song0Younsu Lee1Kyuil Kim2Seokhun Kim3SooKyun Kim4Sang-Soo Choi5 Korea University of Science and Technology, Daejeon 305-350, Republic of Korea Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of Korea Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of Korea Department of Mobile Media, Suwon Women's University, Suwon 441-748, Republic of Korea Department of Game Engineering, Pai Chai University, Daejeon 302-735, Republic of Korea Korea Institute of Science and Technology Information, Daejeon 305-806, Republic of KoreaWe present an automated verification methodology of the security events, that is, IDS alerts, based on heuristic analysis. The proposed verification methodology aims to automatically identify real cyberattacks from the security events and filter out false positive, so that the security analyst is able to conduct security monitoring and response more effectively. For the proposed verification methodology, we used the 1,528,730,667 security events that were obtained from Science and Technology Security Center (S&T-SEC). We then extracted the core security events that were caused by the real cyberattacks. Among the core security events, we selected the top 20 types of the security events in the number of the real attacks that they raised. By analyzing the top 20 types of the security events, we discovered essential elements and optional elements for using in the automated verification of the security events. The evaluation results showed that the proposed verification methodology could contribute to the reduction (about 67%) of the meaningless security events. Furthermore, we demonstrated that the proposed verification methodology contributed to the detection of 140 true negatives that were not identified by the security analyst and the total accuracy of the proposed verification methodology was 96.1%.https://doi.org/10.1155/2015/817918 |
| spellingShingle | Jungsuk Song Younsu Lee Kyuil Kim Seokhun Kim SooKyun Kim Sang-Soo Choi Automated Verification Methodology of Security Events Based on Heuristic Analysis International Journal of Distributed Sensor Networks |
| title | Automated Verification Methodology of Security Events Based on Heuristic Analysis |
| title_full | Automated Verification Methodology of Security Events Based on Heuristic Analysis |
| title_fullStr | Automated Verification Methodology of Security Events Based on Heuristic Analysis |
| title_full_unstemmed | Automated Verification Methodology of Security Events Based on Heuristic Analysis |
| title_short | Automated Verification Methodology of Security Events Based on Heuristic Analysis |
| title_sort | automated verification methodology of security events based on heuristic analysis |
| url | https://doi.org/10.1155/2015/817918 |
| work_keys_str_mv | AT jungsuksong automatedverificationmethodologyofsecurityeventsbasedonheuristicanalysis AT younsulee automatedverificationmethodologyofsecurityeventsbasedonheuristicanalysis AT kyuilkim automatedverificationmethodologyofsecurityeventsbasedonheuristicanalysis AT seokhunkim automatedverificationmethodologyofsecurityeventsbasedonheuristicanalysis AT sookyunkim automatedverificationmethodologyofsecurityeventsbasedonheuristicanalysis AT sangsoochoi automatedverificationmethodologyofsecurityeventsbasedonheuristicanalysis |