Evaluation of local security event management system vs. standard antivirus software

A. Pérez-Sánchez, R. Palacios

Applied Sciences Vol. 12, nº. 3, pp. 1076-1 - 1076-18

Resumen:

The detection and classification of threats in computer systems has been one of the main problems researched in Cybersecurity. As technology evolves, the tactics employed by adversaries have also become more sophisticated to evade detection systems. In consequence, systems that previously detected and classified those threats are now outdated. This paper proposes a detection system based on the analysis of events and matching the risk level with the MITRE ATT&CK matrix and Cyber Kill Chain. Extensive testing of attacks, using nine malware codes and applying three different obfuscation techniques, was performed. Each malicious code was analyzed using the proposed event management system and also executed in a controlled environment to examine if commercial malware detection systems (antivirus) were successful. The results show that evading techniques such as obfuscation and in-memory extraction of malicious payloads, impose unexpected difficulties to standard antivirus software.

Palabras Clave: SIEM; antivirus; event-based threat detection; MITRE; Cyber Kill Chain

Índice de impacto JCR y cuartil WoS: 2,700 - Q2 (2022); 2,500 - Q1 (2023)

Referencia DOI: https://doi.org/10.3390/app12031076

Publicado en papel: Febrero 2022.

Publicado on-line: Enero 2022.

Cita:
A. Pérez-Sánchez, R. Palacios, Evaluation of local security event management system vs. standard antivirus software. Applied Sciences. Vol. 12, nº. 3, pp. 1076-1 - 1076-18, Febrero 2022. [Online: Enero 2022]