Unaddressed Limitations in Security Information and Event Management (SIEM) Systems

Abstract

Security Information and Event Management (SIEM) systems are the base for enterprise Security Operation Centers (SOCs); however, they are faced with three main overlapping weaknesses: lack of context to provide alerts about potential threats, inadequate rule-based approach to detect insider threat and alert fatigue due to too many alerts. Lots of solutions have been offered to cope with these problems; however, there is no comprehensive model that can meet all these demands. The model offered in this paper consists of four layers that improve existing SIEMs without replacing the platform. The first layer describes the components of data used by SIEMs. The second layer offers an approach to improve alerts based on the concept of kill chain. The third layer uses unsupervised machine learning methods, specifically Isolation Forest and One-Class SVM to detect insider threat. The fourth layer improves the traditional two-level alerts' model by introducing five levels of alerts. SOC improvement on the grounds of the feedback mechanism principle. The model is evaluated in light of four defined aspects and its theoretical consistency and practical feasibility are studied. The analysis proves that the multi-level structure provides a solution to all the discussed challenges in an integral and cumulative manner. Therefore, it could be considered as a novel theoretical achievement in the area of SIEM and insider threats research. The next step will consist in practical validation of the approach in real businesses