← All talks

Project DiSIEM

BSides Lisbon · 201849:46284 viewsPublished 2018-12Watch on YouTube ↗
Speakers
Tags
About this talk
The DiSIEM project enhances existing SIEM systems with diversity mechanisms: integrating OSINT data sources, developing probabilistic security models and risk-based metrics, designing novel visualization methods, adding redundant monitoring and behavioral anomaly detection, and implementing long-term cloud archival with secret sharing. The talk presents the project's components and tools implemented as plugins for integration into current SIEM deployments.
Show original YouTube description
This talk presents the DiSIEM EU H2020 Project (http://disiem-project.eu/) with a special focus on its impact in terms of innovation and the current results of the project development. The DiSIEM project aims to address the limitations of SIEMs already deployed in production. Instead of proposing novel architectures for future SIEMs or modifications to existing ones, the project addresses these limitations by extending current systems, leveraging their built-in capacity for extension and customisation. The core idea of the project is to enhance existing SIEM systems with several diversity mechanisms, representing five main advances in the state of the art: 1. Integrate diverse OSINT (Open Source Intelligence) data sources available on the web. This data needs to be fetched, analysed, normalised and fused to identify relationships, trends and anomalies and hence help reacting to new vulnerabilities to the infrastructure or even predict possible emerging threats against the infrastructure monitored by the SIEM. 2. Develop novel probabilistic security models and risk-based metrics to help security analysts to decide which infrastructure configurations offer better security guarantees and increase the capacity of SOCs to communicate the status of the organisation to C-level managers. 3. Design and deploy novel visualisation methods to present the diverse live and archival data sets, to better support the decision-making process by enabling the extraction of high-level security insight from the data which will be used by the security analysts working with SOCs that operate the SIEM. 4. Integrate diverse, redundant and enhanced monitoring capabilities to the SIEM ecosystem, to increase the value of the events fed to the system. Likewise, we propose to deploy and integrate novel behavioural anomaly detectors for business-critical applications and thus improve the SIEM’s visibility into the functional security status of these monitored applications. 5. Add support for long term archival of events in public cloud storage services. In order to satisfy the security requirements of such data (which contains a lot of sensitive information), we will store such events in diverse cloud providers (e.g., Amazon, Windows Azure, Google), employing techniques such as secret sharing and information dispersal. These contributions are materialised through a set of tools and components, in the form of plugins, that can be integrated into existing SIEM systems. For example, redundant diverse analysis and trends obtained through OSINT sources can be fed to the SIEM, while new visualisation and analysis tools can be integrated by fetching data from the SIEM event database. The talk will provide an overview of the components that have been implemented in DiSIEM.
Show transcript [en]

who has to play the 18th corner is in this web 2.0 and on the bank's skirt, Project Nim,

the City University of London consortium of Chuchu in cybersecurity, is from Alfa EA Hess, the idea is that Sporting should avoid the use of collect, Guinga classes of William, the sites can destroy, it's an industrial meats, Eva, am Sam Walsh, criticism, Amadeus connects, the company intends in EDP Digital is to mark and closed the range, gum, note 7 thousand peasants from the north or of components and the like, this is independent, they include leasing, it is that in December 2010, so Fitch already the component in crisis, so it is the top, so it goes, finally everything leads

in 2010,

so the use in virtual, the idea is of escort, said this in full of diversityinc, its NASA, nothing vector and all to com boy, facing front and back, will be stored, to Citi acts in software, information is it beats and Chile, São Paulo, do not neglect, even so, the walking component judge a time when the fininvest animal everything like that Maikon Leite in new ways to visuals of data show ii that he was must be our components not integral of I stop going to the fashion show

[Applause]

the evan round

129 of history and was lowering like that 18 buildings of the guide obvious at the end certain chemical components in the union of this component of certain components of the show elected the drive we do it web and

informationweek event god

baptized of qaem new dashboard of that the norm in of wish knows and not even the excess of these note to the ruler I am was instance the ria that neva

information technical rebounds a love story and versa says cantona that used for this story bolton is us when instructing like that doesn't lead back to justice [Music] popular or south and matters in everything together thor hushovd if I had me henin and schwenck and henrique which ones are sectional there is trash ten long long there is a malaise between the seven

[Music]

[Music]

[Music]

[Music]

components of the line of 1069 José Cechin the act outside the zr is fantastic analytics city in cutting yes in design says the Portuguese should enter the digital site is bad campaign on the internet ten acts of escape

god is no it wouldn't

yield let me give up on oe between Dodô last of trade of the city of z the idea is my sport it even stamped lnet the stadium to everything of sailing of the Spanish in the big love of the project health components when reintegrating 128 edp and design binotti member of the top fashion week - 10 and coach in an interview with uol by chan siu lan says says to nobody

the inter only zan we also the applications whishaw monitor bicing de nieve functional rs at the service of boca fabrications in blocks applications [Music] department organization the kick was missing in shape so suffers information everything is taken or monitors the performance of the football team and I'm good at me

is 0 and 1 to 0 the risk of application of engineering and I'm inspired by west or terrible bill and neto in 10 modules and components [Music]

is from date 10 x the faith of going until the Kors forums are going well said Luis Força event giving thus the 20 hatch and sedan 10 by Nená his friends both upstairs incidents in Sanaa in the last I demonstrated small tribe and that not the voter some and thread to go up the film the business web I classified Chan the host

to change in Gogan Silva Bronz at night 10 mm Mauá I am warning and I heard that in certain and left to be foresees building seven thousand down and everything serves if of application and the authentic of application service Ipis

pink 10 powder [Applause] [Music]

instead I decided Sam Chan

this newspaper and Milan what we do senate is not to stay below the company are the automotive between tector of architecture of the of 100 components purpose y a 9 of absent from Firjan in analyses of the components since it involves 11 between Stuttgart prototype will Dubai uses BioWare clients of a dress to Google these components this is an exclusive infamy but promises response or beats more information or date I only bought because Kan saw his best said everything is according to the process the divorce process [Music] so far out of sound is a process one of the hits between Iturbe Forte and I'm on the set of The Office and Forte including one of the

three components

the monitor to form a bad player says are the partners of the mode of mode the els alex detect mind of the partners of the components in 35 modules sound module of agogôs process in a Ford Ka shing

of the X Factor positive presentation pro

2011 including with the New York

Times indicated neural network mode the assets of PJ 85 min

and this city hall ends of crisis in which bits of which the Sims 17 workaholics team continue in debt what will give you collective of module 7 pro form of R 37 the Kospi index in Sydney Chan Wai Chi club while 94 in informed Nike bought more However, Fred, at 47 years old, even with so many from the coast within the scope of the event, and the example of the FAMs headquarters, this event becomes a kind of obstacle course with performance, the blood of the lord today on two ecological themes, approving horizons of the order of arrival, Gizmodo in the field, we are from the store, thus aiming, years demonstrates, says Luis, body, some reinforcements, important moment

in the form of horns, championship, thus the Android of the environmental component,

thus the physical order, then the name, statizing, countdown to, thus the Zoe, however, the Wi-Fi version, fan of José Wilson, Michael Caine, to stay of components, then I learned of the interest of Sporting and the present, Next Star Wars, shipments, the visual of the quota of the Information Company, observation, the order of impact in mines, to the present conflict of the sport

[Music]

Sanaa, the need to divide from top, says the pilot of the software, says between Iceland, Isis, for example, is still present, and Alex is in Sofia with two chips,

Wilson, proven links, soldier, only completes the tremor, information, catch 18 rebounds, goes in the river, Eva walker, 10 poors and fitch the new division the animated the amount of information collectors the team a graph a symbol of the total collection of 15 days before had already gone the component where planes and even more represent tweets act filters device edson mano at the head of the troupe of Francisco's sons and brother of the Mexican painter Aleks in 2010 she want to change the world

[Music] [Music] Luiz says component of the Detran Fernando [Applause] service in order to define all this requires what's new 75 thousand and 100 thousand dead and 175 dogs yen of things of risk module of everything since the forces say never the fan of the program inside this kind of blue sky 999 wins the experience and support to witch mountain cyber security an apple the note the person in charge will go from application near Pittsburgh waits health sesma of support all cyber security information as a gift your bond girl and hot wheels in the state shams I'm bi and business analysis said business is not be said that knows if the team from the slaughter what is and what is not

with this fae and race in terms of critical and France if it was seen is webservice 7 if critical for business odor I classified shams text more boorish and what defines the united with this fae that insert areas said Nilza of franchise with the CEF box to back they say date 10 and the f tutu known I classified chan [ __ ] green of mobile says that had access to small organization I classified organization times possess of arce - wii in his speech the actor that include your business veil and was included in a single year and 1989 the Florence Haw involved considerations that makes sun and how much the route and open field not even pizza see them

web service because canté public accounts will outlev more packages