• English
    • español
  • español 
    • English
    • español
  • Login
Ver ítem 
  •   DSpace Principal
  • 2.- Investigación
  • Artículos
  • Ver ítem
  •   DSpace Principal
  • 2.- Investigación
  • Artículos
  • Ver ítem
JavaScript is disabled for your browser. Some features of this site may not work without it.

Evaluation of local security event management system vs. standard antivirus software

Thumbnail
Ver/
IIT-22-010R.pdf (1.071Mb)
Fecha
2022-02-01
Autor
Pérez Sánchez, Antonio
Palacios Hielscher, Rafael
Estado
info:eu-repo/semantics/publishedVersion
Metadatos
Mostrar el registro completo del ítem
Mostrar METS del ítem
Ver registro en CKH

Refworks Export

Resumen
 
 
The detection and classification of threats in computer systems has been one of the main problems researched in Cybersecurity. As technology evolves, the tactics employed by adversaries have also become more sophisticated to evade detection systems. In consequence, systems that previously detected and classified those threats are now outdated. This paper proposes a detection system based on the analysis of events and matching the risk level with the MITRE ATT&CK matrix and Cyber Kill Chain. Extensive testing of attacks, using nine malware codes and applying three different obfuscation techniques, was performed. Each malicious code was analyzed using the proposed event management system and also executed in a controlled environment to examine if commercial malware detection systems (antivirus) were successful. The results show that evading techniques such as obfuscation and in-memory extraction of malicious payloads, impose unexpected difficulties to standard antivirus software.
 
URI
https:doi.org10.3390app12031076
Evaluation of local security event management system vs. standard antivirus software
Tipo de Actividad
Artículos en revistas
ISSN
2076-3417
Materias/ categorías / ODS
Instituto de Investigación Tecnológica (IIT)
Palabras Clave

SIEM; antivirus; event-based threat detection; MITRE; Cyber Kill Chain
Colecciones
  • Artículos

Repositorio de la Universidad Pontificia Comillas copyright © 2015  Desarrollado con DSpace Software
Contacto | Sugerencias
 

 

Búsqueda semántica (CKH Explorer)


Listar

Todo DSpaceComunidades & ColeccionesPor fecha de publicaciónAutoresTítulosMateriasPor DirectorPor tipoEsta colecciónPor fecha de publicaciónAutoresTítulosMateriasPor DirectorPor tipo

Mi cuenta

AccederRegistro

Repositorio de la Universidad Pontificia Comillas copyright © 2015  Desarrollado con DSpace Software
Contacto | Sugerencias