Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection
Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection
复制标题
通过用于加密 Skype 流量检测的增强型探测器来提高 SIEM 功能
DOI：
10.1016/j.jisa.2017.12.001
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Cesario Di Sarno
中科院分区：
文献类型：
--
作者：
M. Mauro;Cesario Di Sarno
如今，安全信息和事件管理（SIEM）系统在处理互联网服务提供商的关键基础设施的安全问题方面具有重要意义。基本上，SIEM具有两个主要功能：（i）收集和聚合来自不同网络设备（路由器、防火墙、入侵检测系统、ad hoc探针等）的日志数据和安全信息，以及（ii）通过实施一组相关规则来分析所收集的数据，该相关规则旨在检测潜在的可疑事件，如加密的实时流量的存在。在目前的工作中，作者提出了一个SIEM的增强实现，其中一个特别的重点是通过使用一个特设开发的增强型探头（ESkyPRO）方便地由SIEM本身管理的加密Skype流量的检测。这种增强型探测器能够与部署到SIEM平台中的代理对手进行交互，通过利用一些机器学习概念来设计。所提出的ad-hoc SIEM的主要目的是将ESkyPRO接收到的信息与入侵检测系统（IDS）探测器获得的其他类型的数据相关联，以便尽可能准确地检测加密的Skype流量。
Nowadays, the Security Information and Event Management (SIEM) systems take on great relevance in handling security issues for critical infrastructures as Internet Service Providers. Basically, a SIEM has two main functions: ((i) the collection and the aggregation of log data and security information from disparate network devices (routers, firewalls, intrusion detection systems, ad hoc probes and others) and ((ii) the analysis of the gathered data by implementing a set of correlation rules aimed at detecting potential suspicious events as the presence of encrypted real-time traffic. In the present work, the authors propose an enhanced implementation of a SIEM where a particular focus is given to the detection of encrypted Skype traffic by using an ad-hoc developed enhanced probe (ESkyPRO) conveniently governed by the SIEM itself. Such enhanced probe, able to interact with an agent counterpart deployed into the SIEM platform, is designed by exploiting some machine learning concepts. The main purpose of the proposed ad-hoc SIEM is to correlate the information received byESkyPROand other types of data obtained by an Intrusion Detection System (IDS) probe in order to make the encrypted Skype traffic detection as accurate as possible.