A Distributed System for Early Intrusion Detection and Assessment of Cybersecurity
<p id="p2">Centralized intrusion detection and prevention systems (IDS/IPS) and Security Information Event Management (SIEM) systems often fail to analyze and respond to information and cybersecurity threats that occur in distributed and heavily loaded environments due to computational, storage, and...
Guardado en:
| Autores principales: | , , , |
|---|---|
| Formato: | Capítulo de libro |
| Lenguaje: | inglés |
| Publicado: |
IntechOpen
2025
|
| Materias: | |
| Acceso en línea: | https://www.intechopen.com/chapters/1185313 |
| Etiquetas: |
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| Sumario: | <p id="p2">Centralized intrusion detection and prevention systems (IDS/IPS) and Security Information Event Management (SIEM) systems often fail to analyze and respond to information and cybersecurity threats that occur in distributed and heavily loaded environments due to computational, storage, and license limitations. In this chapter, we propose a novel distributed hierarchical system concept for early intrusion detection and subsequent assessment of cyber and information security risks based on anomalous behavior analysis without using predefined patterns. The developed approach aims to increase the security of distributed systems against decentralized attacks including both DDoS and non-specific, non-DDoS attacks, such as advanced persistent threats (APT) conducted by high-skilled cybercrimes and state-sponsored adversaries. We expect the proposed concept to improve the performance of SIEM systems compared to centralized solutions. The increasing productivity effectiveness indicator depends on the possible number of hierarchy levels in the analyzed systems (the possibility of their decomposition into subsystems).</p> |
|---|---|
| ISBN: | 978-0-85466-701-7 |
| DOI: | 10.5772/intechopen.1007155 |