A Dangerousness-Based Investigation Model for Security Event Management

Veronique Legrand (1) , Radu State (2) , Luc Paffumi (3)

1 ARES - Architectures of networks of services
2 MADYNES - Management of dynamic networks and services
3 Exaprotect - Exaprotect

The current landscape of security management solutions for large scale networks is limited by the lack of supporting approaches capable to deal with the huge number of alarms and events that are generated on current networks. In this paper we propose a security management architecture, capable to reconstruct causal dependencies from captured network and service alarms. The key idea is based on mapping events in semantic spaces, where a novel algorithm can determine such dependencies. We have implemented a prototype and tested it on a operational network within an outsourced security management suite protecting multiple networks.

Domaines: Cryptographie et sécurité [cs.CR]

Veronique Legrand, Radu State, Luc Paffumi. A Dangerousness-Based Investigation Model for Security Event Management. The Third International Conference on Internet Monitoring and Protection, Jun 2008, Bucharest, Romania. pp.109 - 118. ⟨hal-00405369⟩