Cybersecurity Researchers at NSTU NETI Teach Security Systems to Distinguish Good Data From Bad
Researchers at NSTU NETI are developing a methodology that will help cybersecurity specialists determine whether data fed into monitoring systems is actually suitable for detecting hacker attacks.
SIEM-class systems collect events from corporate infrastructure and automatically search for signs of threats. However, even a properly configured system can fail to detect attacks—not because data is unavailable, but because the data is of poor quality. Graduate researcher Maksim Kiselev, under the supervision of Associate Professor Andrey Ivanov, is developing a tool designed to identify such problems.
The methodology is based on a logging deficiency metric. It evaluates data completeness, the presence of required fields, and the accuracy of timestamps. Attack scenarios are described using the international MITRE ATT&CK knowledge base. The development is expected to be useful for SOC centers and cybersecurity system administrators.
