Ontology-based detection and incident handling in Security Operations Centers of financial institutions

金融机构安全运营中心基于本体的检测和事件处理

• 批准号: 522331-2017
• 负责人: Fernandez, JoséManuel
• 金额: $ 6.28万
• 依托单位: École Polytechnique de Montréal
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2018
• 资助国家: 加拿大
• 起止时间: 2018-01-01 至 2019-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=650658
• 关键词: Ontology; based; detection; incident; handling

This collaborative industry-academia project supported by Desjardins seeks to develop new analytic techniques and tools to identify and prevent security threats to the Information Technology (IT) infrastructure of financial institutions. The project will leverage knowledge representation techniques based on ontologies, which will be used for describing and integrating information on IT systems coming from diverse data sources into the Security Operations Center (SOC) of the financial institution. The use of these ontologies will further drive the more efficient use of Artificial Intelligence techniques, such as Machine Learning, to enable the creation of more precise and powerful algorithms for generation of alerts and their automated handling in order to alleviate the workload of security analysts in the SOC. The techniques developed in the project will be implemented for various use cases in computer security incident handling. The tools developed under this project will target enhancing the existing detection infrastructure and software solutions while minimizing the operationalization costs. Due to common standards and regulations in the financial industry, we hope that these tools and related best practices can be readily transferred to other Canadian financial institutions.**

这个由 Desjardins 支持的产学合作项目旨在开发新的分析技术和工具，以识别和防止对金融机构信息技术 (IT) 基础设施的安全威胁。该项目将利用基于本体的知识表示技术，用于描述来自不同数据源的 IT 系统信息并将其集成到金融机构的安全运营中心 (SOC) 中。这些本体的使用将进一步推动机器学习等人工智能技术的更有效使用，从而能够创建更精确、更强大的算法来生成警报及其自动处理，从而减轻 SOC 中安全分析师的工作量。该项目开发的技术将应用于计算机安全事件处理的各种用例。该项目开发的工具将致力于增强现有的检测基础设施和软件解决方案，同时最大限度地降低运营成本。由于金融行业的共同标准和法规，我们希望这些工具和相关最佳实践可以轻松转移到其他加拿大金融机构。 **