Högskolan i Skövde

In Security Operations Center there is a need to perceive, comprehend and project cyber activities. Therefore it requires developing Cyber Situational Awareness (CSA) capability that involves perception of different security events, comprehension of the meaning of the current cyber security situation in the organization, and the projection of future status in order to select better positioning of security mechanisms. Current techniques of CSA are limited by the high speed of events generation, large volume of information from multiple sensors, and the complexity of interactions of highly automated services that shape the Cyberspace. This study presents a framework to track and project multistage cyber-attacks supporting CSA activities and enables a faster correlation of event logs using Big Data Technologies.