A threshold-based, real-time analysis in early detection of endpoint anomalies using SIEM expertise. Issue 4 (April 2021)

• Record Type: Journal Article
• Authors: Eswaran, Sivaraman; Srinivasan, Aruna; Honnavalli, Prasad
• Is Part Of: Network security. Volume 2021:Issue 4(2021)
• Page Start: 7
• Page End: 16
• Publication Date: 2021-04
• Subjects: Computer security -- Periodicals; Computer networks -- Security measures -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; Computers -- Access control -- Periodicals; 005.805
• DOI: 10.1016/S1353-4858(21)00039-8
• Languages: English
• ISSNs: 1353-4858

Abstract

Abstract : IT functions in organisations produce enormous quantities of data, logs and events. In the current IT world, handling a large amount of data is a challenging task and it is the responsibility of network administrators to transmit and store the data securely. If any data is disclosed or tampered with by an attacker, either locally or remotely, then the impact can be very high. To overcome this, firewall and intrusion detection system (IDS) and intrusion prevention system (IPS) solutions are used to verify all packets on the network.