TY - GEN
T1 - Analysis of security data from a large computing organization
AU - Sharma, A.
AU - Kalbarczyk, Zbigniew T
AU - Barlow, J.
AU - Iyer, Ravishankar K
PY - 2011
Y1 - 2011
N2 - This paper presents an in-depth study of the forensic data on security incidents that have occurred over a period of 5 years at the National Center for Supercomputing Applications at the University of Illinois. The proposed methodology combines automated analysis of data from security monitors and system logs with human expertise to extract and process relevant data in order to: (i) determine the progression of an attack, (ii) establish incident categories and characterize their severity, (iii) associate alerts with incidents, and (iv) identify incidents missed by the monitoring tools and examine the reasons for the escapes. The analysis conducted provides the basis for incident modeling and design of new techniques for security monitoring.
AB - This paper presents an in-depth study of the forensic data on security incidents that have occurred over a period of 5 years at the National Center for Supercomputing Applications at the University of Illinois. The proposed methodology combines automated analysis of data from security monitors and system logs with human expertise to extract and process relevant data in order to: (i) determine the progression of an attack, (ii) establish incident categories and characterize their severity, (iii) associate alerts with incidents, and (iv) identify incidents missed by the monitoring tools and examine the reasons for the escapes. The analysis conducted provides the basis for incident modeling and design of new techniques for security monitoring.
KW - alerts
KW - incident/attack data analysis
KW - large scale computing systems
KW - security monitoring
UR - http://www.scopus.com/inward/record.url?scp=80051938080&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=80051938080&partnerID=8YFLogxK
U2 - 10.1109/DSN.2011.5958263
DO - 10.1109/DSN.2011.5958263
M3 - Conference contribution
AN - SCOPUS:80051938080
SN - 9781424492336
T3 - Proceedings of the International Conference on Dependable Systems and Networks
SP - 506
EP - 517
BT - 2011 IEEE/IFIP 41st International Conference on Dependable Systems and Networks, DSN 2011
T2 - 2011 IEEE/IFIP 41st International Conference on Dependable Systems and Networks, DSN 2011
Y2 - 27 June 2011 through 30 June 2011
ER -