RU166348U1 - INFORMATION SECURITY EVENT CORRELATION DEVICE - Google Patents

Abstract

An information security event correlation device comprising an information security event receiver, the output of which is connected to the first input of the information security event comparison unit with the rule of the first level correlation directive and with the first input of the information security event comparison unit with the rule of the second level correlation directive, the output of the information event comparison unit security rule of the first level correlation directive is connected to the timer input and to the second input of the compare the information security event with the rule of the second level correlation directive, the output of the information security event comparison unit with the rule of the second level correlation directive is connected to the first input of the event counter, the second input of which is connected to the first timer output, and the output to the alarm generation unit, the output of which is connected to the second input of the information security event comparison unit with the rule of the first level correlation directive, the third input of which is connected to the second output of the timer.

Description

The utility model relates to the field of information security (IS), and more specifically to the detection of attacks on information systems using SIEM systems.

Timely response is critical to eliminating computer attacks on information systems with the least possible loss. In this regard, there are increasing requirements for the efficiency of monitoring, control and response of personnel to events in the information system [1].

The infrastructure of large organizations is becoming more and more complicated, so keeping track of the huge flow of information about IS violations and assessing the significance of each of them can be very difficult. This leads to an increase in the requirements for qualifications and quality of work of information systems personnel.

The solution to the above problems is the use of so-called SIEM systems. (Security Information and Event Management).

A SIEM system is a class of information security solutions focused on supporting management processes, both security and the entire IT infrastructure of an enterprise. SIEM solution allows to carry out [2]:

- centralized collection and analysis of data from event logs of information protection tools, server workstations and network equipment;

- remote control of configuration parameters and work of workstations;

- prompt notification and response to internal and external threats to the security of the automated system;

- monitoring the implementation of specified requirements for information security, collecting statistics and building reports on the security of the information system at any time.

The SIEM system, as a rule, includes:

means for collecting and transmitting information transmitting data on IS events from event sources to the SIEM core of the system;

The core of the SIEM system, consisting of:

means for receiving data on IS events and their aggregation in magazines;

IS event data logs

sensor module, normalizing and transmitting data to the database (DB) of the SIEM system;

DB SIEM-system, which stores archives of IS events, information about IS incidents and information about system settings;

correlation devices with which information security incidents are detected;

as well as a means of interaction between the security administrator and the SIEM system, for example, a web interface.

The correlation device is the basic module of the SIEM system core, the implementation of which largely determines the effectiveness of detection of computer attacks and, as a result, the overall security of the information system.

The prior art system for generating information security alarms [3], based on risk assessment, in which an event management device receives a request to access the corporate network from a client device, in response to a request, sends a web page for client authentication containing a program for extracting profile settings of the client device, then the event management device receives information about the authentication event from the client device and information about the risk assessment from the risk assessment unit, etc. The risk assessment information is based on the profile parameters of the client device, after which the event management device correlates the authentication information and the risk assessment information, if the correlation result corresponds to an authentication attack, the event management device generates an alarm (SIEM alarm), which has priority based on risk assessment.

The disadvantage of this system is its narrow focus, since it allows you to detect attacks only on authentication systems.

The SIEM system [4], which receives a security event, calculates the risk level of a security event, based on the correlation of the security event with the attributes of the network asset managed by the SIEM system, is also known from the prior art; if the risk level corresponds to the predefined one, the SIEM system notifies the system administrator about this.

The disadvantage of this system is the inadequate security of the information system that uses this SIEM system, since its correlation device detects attacks with a low probability.

The technical result, the achievement of which the claimed device is aimed, is to increase the likelihood of detecting attacks on information systems, which in turn leads to increased security of information systems.

The technical result is achieved due to the fact that the information security event correlation device includes an information security event receiver, the output of which is connected to the first input of the information security event comparison unit with the rule of the first level correlation directive and with the first input of the information security event comparison unit with the rule of the directive second-level correlation, output of the information security event comparison unit with the rule of the first-level correlation directive connected to the timer input and to the second input of the information security event comparison unit with the rule of the second level correlation directive, the output of the information security event comparison unit with the second level correlation directive rule is connected to the first input of the event counter, the second input of which is connected to the first timer output, and the output with an alarm generation unit, the output of which is connected to the second input of the information security event comparison unit with the rule of the first level correlation directive, the third input for which it is connected to the second output of the timer.

The information security event correlation device automatically analyzes the collected data and ensures the detection of IS incidents followed by the generation of alarms using a set of correlation directives, which are a sequence of correlation rules of different levels. Correlation rules are generated on the basis of information security network threat patterns and are used for comparison with incoming information security events in comparison blocks with the rules of correlation directives.

The figure 1 shows a device for correlating information security events, containing a receiver of information security events (1), a unit for comparing information security events with the rule of the first level correlation directive (2), a unit for comparing information security events with the rule of the second level correlation directive (3), a timer (4), event counter (5), alarm generation unit (6).

The information security event receiver (1) receives security events from the SIEM database or from external sources. Security events can be the following: loading of the operating system, successful or unsuccessful attempt to enter the operating system, an event from an intrusion detection system, a firewall, an event of copying data, printing a document, etc.

The first security event is fed to the first input of the information security event comparison unit with the rule of the first level correlation directive (2), and if it satisfies the rule of the first level correlation directive, then a signal is issued to the output of the information security event comparison unit with the rule of the first level correlation directive recording subsequent information security events in the unit for comparing information security events with the rule of the second level correlation directive (3) and triggering conductive timer (4).

In this case, the unit for comparing information security events with the rule of the first level correlation directive ceases to process subsequent information security events until an enabling signal arrives at its second or third input.

Subsequent information security events are compared with the rule of the second level correlation directive in the block for comparing information security events with the rule of the second level correlation directive. The number of information security events that satisfy the rule of the second level correlation directive is calculated in the event counter (5), and when a certain (previously set) number of such events is reached, the counter sends a signal to the input of the alarm generation block (6) signaling an attack on the information system.

However, the counter can be reset by a signal from the timer, if during the time set in the timer, the number of information security events that satisfy the rule of the second level correlation directive does not manage to reach a certain (predefined) value in the event counter. In addition to the counter zeroing signal, the timer also generates an enable signal that translates the information security event comparison unit with the rule of the first level correlation directive to the operational state.

When an alarm is generated, the alarm generation unit generates an alarm message that can be sent to the monitor screen output, and can also be sent to the information security administrator by e-mail, or it can be used in any other way to notify of an attack.

In addition, the alarm generation unit gives an enable signal to the second input of the information security event comparison unit with the rule of the first level correlation directive.

After receiving the enabling signal, the information security event comparison unit with the rule of the first level correlation directive is put into operation and is ready to process the next information security event from the information security event receiver.

As an example, consider the following correlation directive.

Let the rule be set at the first level of the correlation directive: "Launch the operating system on any of the computers on the network."

At the second level of the correlation directive, the rule is set: "Invalid username or password."

The timer is set to "5 minutes".

The event counter counts up to 2x.

Thus, when three information security events arrive in 5 minutes that satisfy the rule: “Invalid username or password”, the counter generates a carry signal, which instructs the alarm generation unit to generate an alarm.

Thus, if an operating system is launched on one of the computers on the network, the event falls into the receiver of information security events, and then it is compared in the comparison block of the information security event with the rule of the first level correlation directive with the rule "Run the operating system on any of the network computers" . After that, the user begins to enter a username and password to access the bootable operating system. Events about the entered login and password also fall into the event receiver. And in case the user enters the wrong login and password 3 times within 5 minutes, the alarm generation unit signals the detection of a computer attack.

List of sources

1. Markov A., Fadin A. Convergence of information security tools // Information Protection. Insider. 2013. No4 (52). S. 80-81.

2. Fadin A.A., Avezova I.E. SIEM-solutions for the management and consolidation of information security tools // Automation and Informatics. 2015. No1 (36). S. 27-33.

3. US 9282114 B1, EMC Corporation, Generation of alerts in an event management system based upon risk, G06F 21/55, 08/08/2016

4. US 20150106867 A1, Fortinet, Inc., Security information and event management, H04L 29/06, 04/16/2015

Claims (1)

An information security event correlation device comprising an information security event receiver, the output of which is connected to the first input of the information security event comparison unit with the rule of the first level correlation directive and with the first input of the information security event comparison unit with the rule of the second level correlation directive, the output of the information event comparison unit security rule of the first level correlation directive is connected to the timer input and to the second input of the compare the information security event with the rule of the second level correlation directive, the output of the information security event comparison unit with the rule of the second level correlation directive is connected to the first input of the event counter, the second input of which is connected to the first timer output, and the output to the alarm generation unit, the output of which is connected to the second input of the information security event comparison unit with the rule of the first level correlation directive, the third input of which is connected to the second output of the timer.

Images