New methods to protect our network systems

Abstract

In the last few years the number of security incidents has significantly increased. There were twice as much DDoS attacks than before in the previous year, and this number is still steadily growing. Attaining a reliable defense is growing into a more demanding task as the array of threats is continuously widening. Security Information and Event Management systems (SIEM) is attempting to deal with this problem. The goal of this system is to function by warnings, alarms, and logs based on software and hardware actions, and to gather and analyze this data in real time, ensuring that security related acivities and events are resolved. Major functions of SIEM systems are:
Log consolidation, log management, log normalization, correlation, incident management, reporting , asset management. The main goal of this paper is to offer a brief overview of an open source implementation of a SIEM system. Different lists exist about hostile IP addresses or signatures of malicious code across the internet. Collective Intelligence Framework (CIF) is a framework which’s purpose is to gather this data. If collected, then this data is stored in a database, and an interface is provided for external programs to question the data, which ensures that they can handle the actual network pertinently. A reliable real-time first line of defense can be maintained as a result.