[NLL17] HuMa: A Multi-layer Framework for Threat Analysis in a Heterogeneous Log Environment

Conférence Internationale avec comité de lecture : International Symposium on Foundations and Practice of Security, October 2017, Vol. LNCS, volume 10723, pp.144-159, Nancy, France, (DOI: https://doi.org/10.1007/978-3-319-75650-9_10)

Auteurs: J. Navarro , V. Legrand , S. Lagraa , J. FranÃ§ois , A. Lahmadi , G. De Santis , O. Festor , N. Lammari , F. Hamdi , A. Deruyver , Q. Goux , M. Allard , P. Parrend

Mots clés: Security knowledge, Cybersecurity, Log analysis, Cognitive computing

Résumé: The advent of massive and highly heterogeneous information systems poses major challenges to professionals responsible for IT security. The huge amount of monitoring data currently being generated means that no human being or group of human beings can cope with their analysis. Furthermore, fully automated tools still lack the ability to track the associated events in a fine grained and reliable way. Here, we propose the HuMa framework for detailed and reliable analysis of large amounts of data for security purposes. HuMa uses a multi-analysis approach to study complex security events in a large set of logs. It is organized around three layers: the event layer, the context and attack pattern layer, and the assessment layer. We describe the framework components and the set of complementary algorithms for security assessment. We also provide an evaluation of the contribution of the context and attack pattern layer to security investigation.

BibTeX

@inproceedings {
	NLL17,
	title	=	"{HuMa: A Multi-layer Framework for Threat Analysis in a Heterogeneous Log Environment}",
	author	=	" J. Navarro and V. Legrand and S. Lagraa and J. FranÃ§ois and A. Lahmadi and G. De Santis and O. Festor and N. Lammari and F. Hamdi and A. Deruyver and Q. Goux and M. Allard and P. Parrend ",
	booktitle	=	"{International Symposium on Foundations and Practice of Security}",
	year	=	2017,
	month	=	"October",
	volume	=	LNCS, volume 10723,
	pages	=	"144-159",
	address	=	"Nancy, France",
	doi	=	"https://doi.org/10.1007/978-3-319-75650-9_10",
}