闭合SIEM分析的循环以保护关键的可重构结构
Closing the loop of SIEM analysis to Secure Critical Infrastructures
摘要：
关键基础设施保护是过去几年的主要挑战之一。安全信息和事件管理（SIEM）系统被广泛用于应对这一挑战。然而，它们目前存在一些必须克服的限制。在本文中，我们提出了一个增强的SIEM系统中，我们引入了新的组件，i）使多层数据分析，ii）解决安全策略之间的冲突，并发现未经授权的数据路径，以这种方式能够重新配置网络设备。此外，该系统还通过弹性事件存储来丰富，以确保存储的事件的完整性和不可伪造性。
英文摘要：
Critical Infrastructure Protection is one of the main challenges of last years. Security Information and Event Management (SIEM) systems are widely used for coping with this challenge. However, they currently present several limitations that have to be overcome. In this paper we propose an enhanced SIEM system in which we have introduced novel components to i) enable multiple layer data analysis; ii) resolve conflicts among security policies, and discover unauthorized data paths in such a way to be able to reconfigure network devices. Furthermore, the system is enriched by a Resilient Event Storage that ensures integrity and unforgeability of events stored.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
