Self-Learning SIEM System Using Association Rule Mining
Ravi Raman Tiwari, Anil Kumar Singh, Vrijendra Singh · Journal of Advanced Database Management & Systems · 2015
The rise of new security threats similar to polymorphic multi-step attacks, have made security something just more than perimeter defence, IDS/IPS, Firewalls, Anti-virus etc. Although, security techniques have evolved a lot, so have the attacks. Hence, a comprehensive solution is required wherein all the sensory controls can work in coherence. In this paper, we intend to propose a SIEM system with the self-learning capability which can produce optimized and efficient correlation directives for analysing events in a network, system etc. with the least possible human intervention. We propose a SIEM system with classification-based directives, utilising association rule mining to discover relationships between the event logs and generate rules, based on which we construct classifiers which can distinguish between normal and abnormal behaviour. Cite this Article Ravi Raman Tiwari, Anil Kumar Singh, Vrijendra Singh. Self-Learning SIEM System Using Association Rule Mining. Journal of Advanced Database Management & Systems. 2015; 2(2): 10–23p.