IIT Home Page CNR Home Page

Closing the loop of SIEM analysis to Secure Critical Infrastructures

Critical Infrastructure Protection is one of the main challenges of last years. Security Information and Event Management (SIEM) systems are widely used for coping with this challenge. However, they currently present several limitations that have to be overcome. In this paper we propose an enhanced SIEM system in which we have introduced novel components to i) enable multiple layer data analysis; ii) resolve conflicts among security policies, and discover unauthorized data paths in such a way to be able to reconfigure network devices. Furthermore, the system is enriched by a Resilient Event Storage that ensures integrity and unforgeability of events stored.

BIG4CIP, Newcastle , 2014

External authors: Alessia Garofalo (University of Naples ”Parthenope”, Department of Engineering, Naples, Italy), Cesario Di Sarno (University of Naples ”Parthenope”, Department of Engineering, Naples, Italy), Marco Vallini (Politecnico di Torino, Dip. di Automatica ed Informatica, Torino, Italy), Valerio Formicola (University of Naples ”Parthenope”, Department of Engineering, Naples, Italy)
IIT authors:

Type: Article in proceedings of international peer-reviewed conference
Field of reference: Computer Science & Engineering

Activity: Metodi formali per la sicurezza di sistemi ICT
Sicurezza delle infrastrutture critiche