Using security logs for collecting and reporting technical security metrics

Proceedings - IEEE Military Communications Conference MILCOM

Volumn , Issue , 2014, Pages 294-299

  Vaarandi, Risto ^a   Pihelgas, Mauno ^a  

^a NATO Cooperative Cyber Defence Centre of Excellence   (Estonia)

Author keywords

security log analysis; security metrics

Indexed keywords

NETWORK SECURITY; WELL LOGGING;

FLOW DATA; LOG ANALYSIS; MEASURING SYSTEMS; NETWORK IDS; OPEN-SOURCE TECHNOLOGY; SECURITY LOGS; SECURITY METRICS; TECHNICAL SECURITY;

MILITARY COMMUNICATIONS;

EID: 84912567017     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/MILCOM.2014.53     Document Type: Conference Paper

References (33)

1. B. Alshammari, C. Fidge, and D. Corney, "Security Metrics for Object-Oriented Class Designs," in Proceedings of 2009 International Conference on Quality Software, pp. 11-20
2. T. Heyman, R. Scandariato, C. Huygens, and W. Joosen, "Using security patterns to combine security metrics," in Proceedings of 2008 International Conference on Availability, Reliability and Security, pp. 1156-1163
3. R. M. Savola and P. Heinonen, "A Visualization and Modeling Tool for Security Metrics and Measurements Management," in Proceedings of 2011 Information Security for South Africa Conference, pp. 1-8
4. R. Barabanov, S. Kowalski, and L. Yngström, "Information Security Metrics: Research Directions," University of Stockholm, Technical Report, 2011
5. W. Boyer and M. McQueen, "Ideal Based Cyber Security Technical Metrics for Control Systems," in Proceedings of 2007 International Conference on Critical Information Infrastructures Security, pp. 246-260
6. C. A. da Silva, A. S. Ferreira, and P. L. de Geus, "A Methodology for Management of Cloud Computing using Security Criteria," in Proceedings of 2012 IEEE Latin American Conference on Cloud Computing, pp. 49-54
7. R. A. Kisner, W. W. Manges, L. P. MacIntyre, J. J. Nutaro, J. K. Munro, P. D. Ewing, M. Howlander, P. T. Kuruganti, R. M. Wallace, and M. M. Olama, "Cybersecurity through Real-Time Distributed Control Systems," Oak Ridge National Laboratory, Technical Report ORNL/TM-2010/30, February 2010
8. A. McIntyre, B. Becker, and R. Halbgewachs, "Security Metrics for Process Control Systems," Sandia National Laboratories, Sandia Report SAND2007-2070P, September 2007
9. M. Mateski, C. M. Trevino, C. K. Veitch, J. Michalski, J. M. Harris, S. Maruoka, and J. Frye, "Cyber Threat Metrics," Sandia National Laboratories, Sandia Report SAND2012-2427, March 2012
10. ISO/IEC 27004:2009 standard "Information technology-Security techniques-Information security management-Measurement", 2009
11. A. Jaquith, Security Metrics: Replacing Fear, Uncertainty, and Doubt. Addison-Wesley, 2007
12. W. K. Brotby and G. Hinson, PRAGMATIC Security Metrics: Applying Metametrics to Information Security. Auerbach Publications, 2013
13. P. E. Black, K. Scarfone, and M. Souppaya, "Cyber Security Metrics and Measures," in Wiley Handbook of Science and Technology for Homeland Security, John Wiley and Sons, 2009
14. "The CIS Security Metrics," The Center for Internet Security, Technical Report, version 1. 1. 0, November 1 2010
15. "The Critical Controls for Effective Cyber Defense," Council on CyberSecurity, Technical Report, version 5. 0, 2014
16. R. Vaarandi and K. Podi?š, "Network IDS Alert Classification with Frequent Itemset Mining and Data Clustering," in Proceedings of the 2010 IEEE Conference on Network and Service Management, pp. 451-456
17. http://rules. emergingthreats. net/fwrules/emerging-Block-IPs. txt
18. R. Hofstede, I. Drago, A. Sperotto, R. Sadre, and A. Pras, "Measurement Artifacts in NetFlow Data," in Proceedings of the 2013 Passive and Active Measurement Conference, pp. 1-10
19. B. Trammell, B. Tellenbach, D. Schatzmann, and M. Burkhardt, "Peeling Away Timing Error in NetFlow Data," in Proceedings of the 2011 Passive and Active Measurement Conference, pp. 194-203
20. R. Vaarandi, "Detecting Anomalous Network Traffic in Organizational Private Networks," in Proceedings of the 2013 IEEE CogSIMA Conference, pp. 285-292
21. R. Anthony, "Detecting Security Incidents Using Windows Workstation Event Logs," SANS Institute, InfoSec Reading Room Paper, June 19 2013
22. R. Vaarandi, "Simple Event Correlator for real-time security log monitoring," Hakin9 Magazine, vol. 1/2006 (6), pp. 28-39, 2006
23. "Spotting the Adversary with Windows Event Log Monitoring," National Security Agency/Central Security Service, Information Assurance Directorate, Technical Report, Revision 2, December 16 2013
24. R. Vaarandi and M. R. Grimaila, "Security Event Processing with Simple Event Correlator," Information Systems Security Association Journal, vol. 10(8), pp. 30-37, 2012
25. http://nxlog. org
26. http://www. balabit. com/network-security/syslog-ng
27. http://graphite. readthedocs. org
28. http://nfsen. sourceforge. net
29. http://www. elasticsearch. org
30. http://www. elasticsearch. org/overview/kibana/
31. http://www. rsyslog. com
32. http://logstash. net
33. R. Vaarandi and P. Niziski, "Comparative Analysis of Open-Source Log Management Solutions for Security Monitoring and Network Forensics," in Proceedings of the 2013 European Conference on Information Warfare and Security, pp. 278-287