INTELLIGENT SYSTEM OF INFORMATION SECURITY INCIDENT ANALYSIS (BASED ON THE METHODOLOGY OF SIEM-SYSTEMS USING IMMUNOCOMPUTING MECHANISMS)
The article is devoted to the problem of information security incidents intelligent analysis using the security information and event management system methodology. The essence of such systems, and its ability to interact with the methods of artificial intelligence were analyzed. The developed distributed information security incident analysis system was described, which synthesized the mechanisms of the artificial immune system and the correlation analysis of data to identify known and unknown anomalies, analyze their criticality and determine priorities in response. The modules interaction diagram of the developed system and the mathematical component of the applied method for correlation analysis of data were presented. A series of computational experiments was conducted, which showed a high level of system efficiency in detecting anomalies and the possibility of additional training of each other by client modules, as well as the successful implementation of correlation analysis of data from clients in a given time interval, highlighting the most significant incidents for last analyzed interval, as well as for all the time, both in the complex and for each group of incidents. A graphical display of statistical data by the server allows you to visually assess the criticality of certain incidents and to determine priorities in responding to them.