Ontology-based detection and incident handling in Security Operations Centers of financial institutions

点击翻译按钮获取中文摘要

This collaborative industry-academia project supported by Desjardins seeks to develop new analytic techniques and tools to identify and prevent security threats to the Information Technology (IT) infrastructure of financial institutions. The project will leverage knowledge representation techniques based on ontologies, which will be used for describing and integrating information on IT systems coming from diverse data sources into the Security Operations Center (SOC) of the financial institution. The use of these ontologies will further drive the more efficient use of Artificial Intelligence techniques, such as Machine Learning, to enable the creation of more precise and powerful algorithms for generation of alerts and their automated handling in order to alleviate the workload of security analysts in the SOC. The techniques developed in the project will be implemented for various use cases in computer security incident handling. The tools developed under this project will target enhancing the existing detection infrastructure and software solutions while minimizing the operationalization costs. Due to common standards and regulations in the financial industry, we hope that these tools and related best practices can be readily transferred to other Canadian financial institutions.**