Mobile agent-based SIEM for event collection and normalization externalization

PurposeThis paper aims to propose a mobile agent-based security information and event management architecture (MA-SIEM) that uses mobile agents for near real-time event collection and normalization on the source device. The externalization of the normalization process, executed by several distribute...

Full description

Saved in:
Bibliographic Details
Published in:Information and computer security 2020-04, Vol.28 (1), p.15-34
Main Authors: Moukafih, Nabil, Orhanou, Ghizlane, Elhajji, Said
Format: Article
Language:English
Subjects:
Agents (artificial intelligence)
Automation
Big Data
Correlation analysis
Events planning
Information management
Malware
Mobile computing
Network security
Real time
Security
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:PurposeThis paper aims to propose a mobile agent-based security information and event management architecture (MA-SIEM) that uses mobile agents for near real-time event collection and normalization on the source device. The externalization of the normalization process, executed by several distributed mobile agents on interconnected computers and devices, proposes a SIEM server dedicated mainly for correlation and analysis.Design/methodology/approachThe architecture has been proposed in three stages. In the first step, the authors described the different aspects of the proposed approach. Then they implemented the proposed architecture and presented a new vision for the insertion of normalized data into the SIEM database. Finally, the authors performed a numerical comparison between the approach used in the proposed architecture and that of existing SIEM systems.FindingsThe results of the experiments showed that MA-SIEM systems are more efficient than existing SIEM systems because they leave the SIEM resources primarily dedicated to advanced correlation analysis. In addition, this paper takes into account realistic scenarios and use-cases and proposes a fully automated process for transferring normalized events in near real time to the SIEM server for further analysis using mobile agents.Originality/valueThe work provides new insights into the normalization security-related events using light mobile agents.
ISSN:2056-4961
2056-497X
DOI:10.1108/ICS-01-2019-0008