English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Nowadays, targeted attacks like Advanced Persistent Threats (APTs) has becomeone of the major concern of many enterprise networks. As a common approach tocounter these attacks, security staff deploy a variety of security andnon-security sensors at different lines of defense (Network, Host, andApplication) to track the attacker's behaviors during their kill chain.However, one of the drawbacks of this approach is the huge amount of eventsraised by heterogeneous security and non-security sensors which makes itdifficult to analyze logged events for later processing i.e. event correlationfor timely detection of APT attacks. Till now, some research papers have beenpublished on event aggregation for reducing the volume of logged low-levelevents. However, most research works have been provided a method to aggregatethe events of a single-type and homogeneous event source i.e. NIDS. Inaddition, their main focus is only on the degree to which the event volume isreduced, while the amount of security information lost during the eventaggregation process is also very important. In this paper, we propose athree-phase event aggregation method to reduce the volume of loggedheterogeneous events during APT attacks considering the lowest rate of loss ofsecurity information. To this aim, at first, low-level events of the sensorsare clustered into some similar event groups and then, after filtering noisyevent clusters, the remained clusters are summarized based on anAttribute-Oriented Induction (AOI) method in a controllable manner to reducethe unimportant or duplicated events. The method has been evaluated on thethree publicly available datasets: SotM34, Bryant, and LANL. The experimentalresults show that the method is efficient enough in event aggregation and canreduce events volume up to 99.7\% with an acceptable level of information lossratio (ILR).

Towards event aggregation for reducing the volume of logged events during IKC stages of APT attacks