To read the full version of this content please select one of the options below:

Mobile agent-based SIEM for event collection and normalization externalization

Nabil Moukafih (Laboratory of Mathematics, Computing and Applications – Information Security, Faculty of Sciences, Mohammed V University in Rabat, Rabat, Morocco)
Ghizlane Orhanou (Laboratory of Mathematics, Computing and Applications – Information Security, Faculty of Sciences, Mohammed V University in Rabat, Rabat, Morocco)
Said Elhajji (Laboratory of Mathematics, Computing and Applications – Information Security, Faculty of Sciences, Mohammed V University in Rabat, Rabat, Morocco)

Information and Computer Security

ISSN: 2056-4961

Article publication date: 25 September 2019

Issue publication date: 3 April 2020

Abstract

Purpose

This paper aims to propose a mobile agent-based security information and event management architecture (MA-SIEM) that uses mobile agents for near real-time event collection and normalization on the source device. The externalization of the normalization process, executed by several distributed mobile agents on interconnected computers and devices, proposes a SIEM server dedicated mainly for correlation and analysis.

Design/methodology/approach

The architecture has been proposed in three stages. In the first step, the authors described the different aspects of the proposed approach. Then they implemented the proposed architecture and presented a new vision for the insertion of normalized data into the SIEM database. Finally, the authors performed a numerical comparison between the approach used in the proposed architecture and that of existing SIEM systems.

Findings

The results of the experiments showed that MA-SIEM systems are more efficient than existing SIEM systems because they leave the SIEM resources primarily dedicated to advanced correlation analysis. In addition, this paper takes into account realistic scenarios and use-cases and proposes a fully automated process for transferring normalized events in near real time to the SIEM server for further analysis using mobile agents.

Originality/value

The work provides new insights into the normalization security-related events using light mobile agents.

Keywords

Citation

Moukafih, N., Orhanou, G. and Elhajji, S. (2020), "Mobile agent-based SIEM for event collection and normalization externalization", Information and Computer Security, Vol. 28 No. 1, pp. 15-34. https://doi.org/10.1108/ICS-01-2019-0008

Publisher

:

Emerald Publishing Limited

Copyright © 2019, Emerald Publishing Limited