The article presents a model for identifying cyber incidents by a SIEM system that occur in the course of operation of information and communication systems (ICS). A list of tasks performed by the SIEM system in the ICS protection circuit and the mechanisms that form its basis, which, in turn, are components of the general process of correlation of events occurring in the ICS, is given. The methods of the correlation process aimed at removing, combining and linking data on events in the ICS with the establishment of its causality and priority are analyzed. It is concluded that the existing methods are ineffective in the context of incomplete and inaccurate information about cyber incidents. The tuple model for recognizing cyber incidents is analyzed and an improved model based on the theory of fuzzy sets and linguistic terms is proposed to eliminate its shortcomings. A new formulation of the problem of recognizing cyber incidents is proposed, which is reduced to their identification. The methods for solving it are analyzed and a number of their significant shortcomings are identified, which make it difficult to use them in practice. An approach to solving the formulated problem of
📖 افتح في inklap 🔗 DOI 📮 اطلب بحثاً