Enhancing Security Monitoring with AI-Enabled Log Collection and NLP Modules on a Unified Open Source Platform

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26220%2F23%3APU148783" target="_blank" >RIV/00216305:26220/23:PU148783 - isvavai.cz</a>

Result on the web

<a href="https://www.eeict.cz/eeict_download/archiv/sborniky/EEICT_2023_sbornik_2_v2.pdf" target="_blank" >https://www.eeict.cz/eeict_download/archiv/sborniky/EEICT_2023_sbornik_2_v2.pdf</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.13164/eeict.2023.217" target="_blank" >10.13164/eeict.2023.217</a>

Result language

angličtina

Original language name

Enhancing Security Monitoring with AI-Enabled Log Collection and NLP Modules on a Unified Open Source Platform

Original language description

The number of computer attacks continues to increase daily, posing significant challenges to modern security administrators to provide security in their organizations. With the rise of sophisticated cyber threats, it is becoming increasingly difficult to detect and prevent attacks using traditional security measures. As a result, security monitoring solutions such as Security Information and Event Management (SIEM) have become a critical component of modern security infrastructures. However, these solutions still face limitations, and administrators are constantly seeking ways to enhance their capabilities to effectively protect their cyber units. This paper explores how advanced deep learning techniques can help boost security monitoring capabilities by utilizing them throughout all stages of log processing. The presented platform has the potential to fundamentally transform and bring about a significant change in the field of security monitoring with advanced AI capabilities. The study includes a detailed comparison of modern log collection platforms, with the goal of determining the most effective approach. The key benefits of the proposed solution are its scalability and multipurpose nature. The platform integrates an open source solution and allows the organization to connect any event log sources or the entire SIEM solution, normalize and filter data, and use this data to train and deploy different AI models to perform different security monitoring tasks more efficiently.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

20203 - Telecommunications

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2023

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Proceedings II of the 29th Conference STUDENT EEICT 2023 Selected Papers

ISBN

978-80-214-6154-3

ISSN

2788-1334

e-ISSN

—

Number of pages

4

Pages from-to

217-221

Publisher name

Brno University of Technology; The Faculty of Electrical Engineering and Communication

Place of publication

Brno

Event location

Brno

Event date

Apr 25, 2023

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—