钻井企业安全信息事件管理SIEM系统的设计与实现

随着中石油集团对智能钻井业务的重视和开展程度不断提高,钻井企业每天产生大量数据。这些数据不仅包含丰富的钻井相关知识,还涉及许多关乎国家和企业利益的战略或商业机密。因此,在数据爆炸和人工智能普及的新时代,对网络与数据安全的要求也日益提高。钻井企业天然具有布局分散、跨越地理区域广泛的特点,相比其他企业,构建安全壁垒的难度更大,需要更多的安全手段。文章提出了一种安全信息事件管理(SIEM,Security Information and Event Management)系统的实现方案。该系统在现有网络安全措施基础上,利用数据融合和机器学习算法扩展出新的系统,可以显著提高网络管理人员的工作效率,更及时准确地发现和处理潜在威胁,有效地加强了企业现有的安全屏障。

基于SIEM的APT检测与防御体系研究

高级持续性威胁(简称APT)是目前面临的最严重的安全威胁,在整个攻击过程中,攻击者会投入大量的人力、财力以及时间,同时还会运用社工以及大量的0day,执行目的明确地针对型攻击,尤其是利用恶意代码,建立加密控制通道,窃取或篡改关键数据。如果被攻击者不具备实时检测与防御的能力,一旦业务系统被成功入侵,将遭受非常严重的经济和业务损失。论文阐述了APT攻击的典型特点和生命周期,以及对企业和组织可能造成的威胁,介绍了APT常见的攻击渠道和技术环节,以及抵御APT攻击面临的技术难题和挑战。为解决这些问题,提出了基于下一代SIEM(安全信息和事件管理)的APT检测与防御体系,将所有安全设备、终端和应用中的日志事件和网络流数据整合起来,实施规范化和关联处理,识别APT攻击特征,从而实时检测和抵御APT攻击,保障业务系统的网络安全,降低业务数据被盗取和篡改的风险。

The Impact of Human Factors in the Implementation of SIEM Systems

This paper describes the process of the implementation of SIEM （security information and event management） systems in IT environment and the impact of human factors on that process. In the introductory part of the paper are listed security systems which are most often used in corporate environments, the key functionalities of SIEM systems and its importance in overall security of the IT environment. Then, the recommendations are listed for the successful implementation of SIEM systems, which goal is a higher level of corporate network environment security. It is further presented optimization of implementation of the SIEM systems through all stages. Further, the influence of the human factor is described in the implementation of these systems as well as the impact of human perceptions in correlations to the detection of attacks.

The Guidelines to Adopt an Applicable SIEM Solution

The need for SIEM (Security Information and even Management) systems increased in the last years. Many companies seek to reinforce their security capabilities to better safeguard against cybersecurity threats, so they adopt multi-layered security strategies that include using a SIEM solution. However, implementing a SIEM solution is not just an installation phase that fits any scenario within any organization;the best SIEM system for an organization may not be suitable at all for another one. An organization should consider other factors along with the technical side when evaluating a SIEM solution. This paper proposes an approach to aid enterprises, in selecting an applicable SIEM. It starts by suggesting the requirements that should be addressed in a SIEM using a systematic way, and then proposes a methodology for evaluating SIEM solutions that measures the compliance and applicability of any SIEM solution. This approach aims to support companies that are seeking to adopt SIEM systems into their environments, suggesting suitable answers to preferred requirements that are believed to be valuable prerequisites an SIEM system should have;and to suggest criteria to judge SIEM systems using an evaluation process composed of quantitative and qualitative methods. This approach, unlike others, is customer driven which means that customer needs are taken into account when following the whole approach, specifically when defining the requirements and then evaluating the suppliers’ solutions.

高效的安全信息与事件管理（SIEM）设计

业务系统中的安全防护技术和产品发展至今，已经非常全面了，包括了防火墙、IDS、主机防护、防病毒、VPN等等，但由于融合度低，容易形成一个个的安全孤岛。现在这些技术产品如果全部纳入了安全信息与事件管理之中。不仅能完成对于这些技术产品的整合，还满足了企业日常管理的需求。比如说安全风险评估策略、防病毒策略、安全资产的管理、安全事故的处置流程等等。本文重点在于如何建立和设计一个高效能的SIEM。

基于SIEM系统的APT攻击检测框架

针对高级持续性威胁(advanced persistent threat,APT)攻击具有潜伏期长、隐蔽性高、针对性强、持续时间长的特点,提出了基于安全信息和事件管理(security information and event management,SIEM)系统的APT攻击检测框架.框架分为网络边界日志分析和内部网络流量分析两大模块,网络边界日志分析模块采用大数据分析技术,实时对各类安全防护设备产生的海量异构安全日志和流量统一整合关联、采用特征码检测技术构建第一层恶意代码检测,在网络边界或主机边界形成对APT攻击的第一道防线;内部网络流量分析模块采用大数据分析技术对内部网络流量进行过滤、与边界日志分析模块联动、结合基于图编辑距离的静态同源分类技术构建第二层恶意代码检测,重点防御C&C加密信道、0day漏洞、变形木马.通过网络取证分析实现了全流量回溯技术发现异常、布隆算法过滤入侵行为、虚拟执行分析技术还原APT攻击事件,以此形成内部网络APT攻击防线.

A Framework for Cybersecurity Alert Distribution and Response Network (ADRIAN)

Security Information and Event Management (SIEM) platforms are critical for organizations to monitor and manage their security operations centers. However, organizations using SIEM platforms have several challenges such as inefficiency of alert management and integration with real-time communication tools. These challenges cause delays and cost penalties for organizations in their efforts to resolve the alerts and potential security breaches. This paper introduces a cybersecurity Alert Distribution and Response Network (Adrian) system. Adrian introduces a novel enhancement to SIEM platforms by integrating SIEM functionalities with real-time collaboration platforms. Adrian leverages the uniquity of mobile applications of collaboration platforms to provide real-time alerts, enabling a two-way communication channel that facilitates immediate response to security incidents and efficient SIEM platform management. To demonstrate Adrian’s capabilities, we have introduced a case-study that integrates Wazuh, a SIEM platform, to Slack, a collaboration platform. The case study demonstrates all the functionalities of Adrian including the real-time alert distribution, alert customization, alert categorization, and enablement of management activities, thereby increasing the responsiveness and efficiency of Adrian’s capabilities. The study concludes with a discussion on the potential expansion of Adrian’s capabilities including the incorporation of artificial intelligence (AI) for enhanced alert prioritization and response automation.

Incident Detection Based on Differential Analysis

Internet services and web-based applications play pivotal roles in various sensitive domains, encompassing e-commerce, e-learning, e-healthcare, and e-payment. However, safeguarding these services poses a significant challenge, as the need for robust security measures becomes increasingly imperative. This paper presented an innovative method based on differential analyses to detect abrupt changes in network traffic characteristics. The core concept revolves around identifying abrupt alterations in certain characteristics such as input/output volume, the number of TCP connections, or DNS queries—within the analyzed traffic. Initially, the traffic is segmented into distinct sequences of slices, followed by quantifying specific characteristics for each slice. Subsequently, the distance between successive values of these measured characteristics is computed and clustered to detect sudden changes. To accomplish its objectives, the approach combined several techniques, including propositional logic, distance metrics (e.g., Kullback-Leibler Divergence), and clustering algorithms (e.g., K-means). When applied to two distinct datasets, the proposed approach demonstrates exceptional performance, achieving detection rates of up to 100%.

移动接入解决方案持续监测机制研究

针对处理机密信息的终端用户设备通过移动通信网安全接入相同保密等级的政府机构内部网络或政府合作企业内部网络的问题,美国国家安全局基于商用密码产品和安全产品给出了双层加密和持续监测的移动接入整体解决方案。解决方案提出了持续监测框架、监测点位置、监测数据收集方法,以及监测点选择、告警触发条件等实施要求。对各监测点网络流量特征、安全事件数据汇集手段、系统动态安全模型的分析,可为基于移动通信网等开放网络的虚拟私有专网整体监测方案设计提供参考。

一种基于One-Class SVM和GP安全事件关联规则生成方法研究

随着信息技术的快速发展,网络安全威胁造成的危害日愈严重.安全信息和事件管理(SIEM)在查找组织内部威胁,可疑行为及其它高级持续攻击(APT)中发挥了重要作用.SIEM的检测能力主要依赖于准确,可靠的关联规则.然而,传统的规则生成方式主要基于专家知识人工编写检测规则,因此成本高,效率低.本文给出了一种具备自适应能力的规则生成框架来自动生成关联规则.首先为了更好地识别未知攻击,提出一种基于单类支持向量机(OneClass SVM)的安全事件分类算法对安全事件进行有效分类,实验分类效果准确率高达97%.其次为了提高规则生成准确率,通过重新定义个体结构,交叉与变异方式,优化了基于遗传编程(GP)的规则生成算法,规则适应度高达94%.实验结果表明,本文提出的框架具备自适应能力来识别未知攻击,具备较高的检测准确率,可有效减少人工参与.同时该框架已经部署在实际生产环境中,和原系统相比可以检测更多攻击类型.

可视化技术在信息安全分析领域的应用

论文分别从可视化方法论、安全可视化设计以及安全可视化示例风方面,探讨了安全可视化技术在信息安全分析中的相关应用。

为“5G制造5G”护航--中兴滨江5G+工业互联网安全体系建设实践

5G定制网呈爆发式增长,新的网络、业务和终端引入了新的安全威胁。本方案以终端安全为切入点,通过开发5GSIEM平台,实现了终端、网络、云平台及数据等四种安全能力,建立了完备的网络安全保障体系,进行了5G+工业互联网安全工作的有益实践。

土著竹种在柬埔寨暹粒省社区林业发展中的应用前景

柬埔寨拥有较丰富的竹类资源,且有较多的传统利用,但竹类资源在社区林业建设中没有得到足够重视。暹粒省面临着经济发展和森林资源匮乏突出矛盾,发展社区林业是缓解这一矛盾的重要途径。当地土著竹种在社区林业发展中具有多方面的优势,应成为发展社区林业的首选树种。

国外酒店员工满意度实证研究及启示——基于柬埔寨暹粒速卡度假酒店的调查

以酒店员工满意度为出发点,以柬埔寨暹粒速卡度假酒店为研究对象,运用因子分析法进行公因子识别,提取出内外部环境、管理体制、福利与机会、个人空间与自由及薪酬状况五个公因子。通过分别计算出公因子的综合得分,识别出影响柬埔寨暹粒速卡度假酒店员工满意度的因素,为提升酒店业员工满意度提供借鉴。

电力调度数据网安全技术理念及前景展望

基于当前调度数据网安全防护的发展实践,以及当今先进的安全架构和思想,探讨了应对潜在的网络攻击威胁、关键安全技术应用的发展思路,论述了新型二次防护系统的可行性,提出了构建基于安全信息事件平台SIEM的调度数据网防护理念,为形成一个现实可行的网络安全防护体系提出了建设性意见,并结合技术对未来发展前景进行了展望。

The History, Trend, Types, and Mitigation of Distributed Denial of Service Attacks

Over time, the world has transformed digitally and there is total dependence on the internet. Many more gadgets are continuously interconnected in the internet ecosystem. This fact has made the Internet a global information source for every being. Despite all this, attacker knowledge by cybercriminals has advanced and resulted in different attack methodologies on the internet and its data stores. This paper will discuss the origin and significance of Denial of Service (DoS) and Distributed Denial of Service (DDoS). These kinds of attacks remain the most effective methods used by the bad guys to cause substantial damage in terms of operational, reputational, and financial damage to organizations globally. These kinds of attacks have hindered network performance and availability. The victim’s network is flooded with massive illegal traffic hence, denying genuine traffic from passing through for authorized users. The paper will explore detection mechanisms, and mitigation techniques for this network threat.

基于统计型积分方程的高斯粗糙面散射计算

基于统计型积分方程方法(Stochastic Integral Equation Method,SIEM)实现了高斯粗糙面的高效散射计算.与传统求解随机粗糙面散射特性的蒙特卡洛法(Monte Carlo Method,MC)相比,该方法采用统计面元格林函数,考虑粗糙面高斯随机分布的场源耦合影响,只需要计算一次矩阵元素和待求未知量,提高了求解粗糙面问题的计算效率.数值结果显示,文中方法与MC吻合,计算效率得到显著提高.

尿素装置包装计数器技改简介

由于尿素装置包装计数器设计方面的缺陷,导致计数偏差很大、故障频发等。更改计数器探头位置,并用SIEMENS S7-200CN对计数器进行改造后,避免了故障,实现了精准计数。

Human-as-a-security-sensor for harvesting threat intelligence

Humans are commonly seen as the weakest link in corporate information security.This led to a lot of effort being put into security training and awareness campaigns,which resulted in employees being less likely the target of successful attacks.Existing approaches,however,do not tap the full potential that can be gained through these campaigns.On the one hand,human perception offers an additional source of contextual information for detected incidents,on the other hand it serves as information source for incidents that may not be detectable by automated procedures.These approaches only allow a text-based reporting of basic incident information.A structured recording of human delivered information that also provides compatibility with existing SIEM systems is still missing.In this work,we propose an approach,which allows humans to systematically report perceived anomalies or incidents in a structured way.Our approach furthermore supports the integration of such reports into analytics systems.Thereby,we identify connecting points to SIEM systems,develop a taxonomy for structuring elements reportable by humans acting as a security sensor and develop a structured data format to record data delivered by humans.A prototypical human-as-a-security-sensor wizard applied to a real-world use-case shows our proof of concept.

Human-as-a-security-sensor for harvesting threat intelligence

Humans are commonly seen as the weakest link in corporate information security.This led to a lot of effort being put into security training and awareness campaigns,which resulted in employees being less likely the target of successful attacks.Existing approaches,however,do not tap the full potential that can be gained through these campaigns.On the one hand,human perception offers an additional source of contextual information for detected incidents,on the other hand it serves as information source for incidents that may not be detectable by automated procedures.These approaches only allow a text-based reporting of basic incident information.A structured recording of human delivered information that also provides compatibility with existing SIEM systems is still missing.In this work,we propose an approach,which allows humans to systematically report perceived anomalies or incidents in a structured way.Our approach furthermore supports the integration of such reports into analytics systems.Thereby,we identify connecting points to SIEM systems,develop a taxonomy for structuring elements reportable by humans acting as a security sensor and develop a structured data format to record data delivered by humans.A prototypical human-as-a-security-sensor wizard applied to a real-world use-case shows our proof of concept.