Algorithms for data collection and processing in information security systems

Abstract

This article presents a study of the event collection and correlation system (SIEM), a comparison of different methods of collecting and processing data in information security systems and methods of collecting and processing data in information security systems, and also identifies the main problems of modern SIEM. The article consists of four sections, the first of which is an introduction, and a conclusion. The introduction reveals the relevance of the topic, identifies the goal and objectives. The second section is devoted to the analysis of data collection and processing methods in information security systems. The definition of such concepts as correlation rules and models in SIEM systems is given. The third section presents the results of the analysis of modern solutions in the field of data collection and processing in information security systems. The fourth section describes the problems and limitations of current SIEMs, and also suggests options for how to neutralize them when creating future SIEMs. The conclusion contains conclusions on the study and suggestions for using its results.