Diseño de una metodología para la detección de ataques a infraestructuras informáticas basada en la correlación de eventos.

Abstract

A methodology which allows to detect cyber-attacks to technological infrastructures was designed based on the correlation of events. The current research work analyzes the difficulty and incompatibility that the logs generated by net active devices evidence in the development of the security analysis. Different device brands and models were analyzed, as well as techniques of events normalization aiming to give effective response to the events happening almost in realtime.

For the simulation of cyber incidents, the OSSTMM and ISAFF methodologies were analyzed and its further adaptation to the proposed methodology, having as scope the Ecuadorian environment and fulfilling the theoretical requirements of the Ministerial Agreement number 166 published by the National Secretariat of Public Administration in the Official Registry number 88 from September 2013. For the design of the methodology, the technology of correlation of events Security Information and Event Management (SIEM) was used, this allows to compare, integrate and visualize security incidents in real-time. Cyber-attacks at application and net level were simulated, they are: Scanning of Ports, SQL injection, Denial of Service, Command Injection, Buffer Overflow and Brute Force, through the analysis of results by means of the inferential statistical technique ANOVA with a level of significance of 0,05, calculated at 95%, it was possible to determine that the methodology for the methodology to detect cyber-attacks to technological infrastructures based on the correlation of events allowed to increase the detection of attacks to cyber infrastructures in 47,8%. The implementation of the methodology in critical infrastructures is recommended.