Ontology-based detection and incident handling in Security Operations Centers of financial institutions

这个由Desjardins支持的产学合作项目旨在开发新的分析技术和工具，以识别和预防对金融机构信息技术（IT）基础设施的安全威胁。该项目将利用基于本体的知识表示技术，用于描述和整合来自不同数据源的IT系统信息，并将其整合到金融机构的安全运营中心（SOC）。这些本体的使用将进一步推动更有效地使用人工智能技术，如机器学习，以创建更精确和强大的算法来生成警报及其自动处理，以减轻SOC中安全分析师的工作量。该项目中开发的技术将用于计算机安全事件处理的各种用例。在该项目下开发的工具将致力于加强现有的检测基础设施和软件解决方案，同时尽量减少运作成本。由于金融行业的共同标准和法规，我们希望这些工具和相关的最佳做法可以随时转移到其他加拿大金融机构。

This collaborative industry-academia project supported by Desjardins seeks to develop new analytic techniques and tools to identify and prevent security threats to the Information Technology (IT) infrastructure of financial institutions. The project will leverage knowledge representation techniques based on ontologies, which will be used for describing and integrating information on IT systems coming from diverse data sources into the Security Operations Center (SOC) of the financial institution. The use of these ontologies will further drive the more efficient use of Artificial Intelligence techniques, such as Machine Learning, to enable the creation of more precise and powerful algorithms for generation of alerts and their automated handling in order to alleviate the workload of security analysts in the SOC. The techniques developed in the project will be implemented for various use cases in computer security incident handling. The tools developed under this project will target enhancing the existing detection infrastructure and software solutions while minimizing the operationalization costs. Due to common standards and regulations in the financial industry, we hope that these tools and related best practices can be readily transferred to other Canadian financial institutions.**