An atomic part of event record that characterizes the separate aspect of object of observed infrastructure. This object participates in the recorded action(s).
Published in Chapter:
Towards Intelligent Data Processing for Automated Determination of Information System Assets
Andrey Fedorchenko (St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS), Russia), Elena Doynikova (St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS), Russia), and Igor Kotenko (St. Petersburg Institute for Informatics and Automation of the Russian Academy of Sciences (SPIIRAS), Russia)
Copyright: © 2020
|Pages: 14
DOI: 10.4018/978-1-7998-1290-6.ch007
Abstract
The chapter discusses how the intelligent data processing techniques, namely, the event correlation, can be used for automated discovery of information system assets. The authors believe that solving of this task will allow more accurate and detailed construction of the risk model for cyber security assessment. This task is complicated by the features of configuration and operation of modern information systems. The chapter describes different types of event analysis, including statistical, structural, dynamic, applied to this task. The authors propose a technique that incorporates determining the types of object characteristics, the types of objects (system assets), and their hierarchy based on the statistical analysis of system events. Significant attention is given to the stage of source data pre-processing. In addition, the developed technique has the broad application prospects to discover the inappropriate, dubious, and harmful information. The case studies and experiments that demonstrate an application of the developed technique are provided and analyzed.