Document Type

Article

Publication Date

7-2012

Abstract

Military and defense organizations rely upon the security of data stored in, and communicated through, their cyber infrastructure to fulfill their mission objectives. It is essential to identify threats to the cyber infrastructure in a timely manner, so that mission risks can be recognized and mitigated. Centralized event logging and correlation is a proven method for identifying threats to cyber resources. However, centralized event logging is inflexible and does not scale well, because it consumes excessive network bandwidth and imposes significant storage and processing requirements on the central event log server. In this paper, we present a flexible, distributed event correlation system designed to overcome these limitations by distributing the event correlation workload across the network of event-producing systems. To demonstrate the utility of the methodology, we model and simulate centralized, decentralized, and hybrid log analysis environments over three accountability levels and compare their performance in terms of detection capability, network bandwidth utilization, database query efficiency, and configurability. The results show that when compared to centralized event correlation, dynamically configured distributed event correlation provides increased flexibility, a significant reduction in network traffic in low and medium accountability environments, and a decrease in database query execution time in the high-accountability case.

Comments

© 2011 The Society for Modeling and Simulation International. (The article was published online ahead of inclusion in an issue of JDMS).

AFIT Scholar furnishes the draft version of this article. The published version of record appears in The Journal of Defense Modeling and Simulation and is available by subscription through the DOI link in the citation below.

DOI

10.1177/1548512911399303

Source Publication

Journal of Defense Modeling and Simulation

Download

Share

COinS