Next-Generation IDS: A CEP Use Case in 10 Minutes

•

7 likes•1,701 views

Next-Generation IDS: A CEP Use Case in 10 Minutes, 3rd Draft – November 8, 2006, 2nd Event Processing Symposium, Redwood Shores, California, Tim Bass, CISSP, Principal Global Architect, Director, TIBCO Software Inc

Technology

Our Agenda ,[object Object],[object Object],[object Object],[object Object]

The Problem What business problem motivated the development of an event processing solution? Intrusion Detection Systems Agent Based Detection Approach Systems Protected Architecture Data Sources Analysis Timing Detection Actions HIDS NIDS Hybrid Audit Logs Net Traffic System Stats Real Time Data Mining Anomaly Detection Signature Detection Centralized Distributed Active Passive

[object Object],The Problem What were the overall design goals the approach? (Illustrative Purposes Only)

The Approach Summarize the overall design of the solution. Source: Bass, T., CACM, 2000

The Approach Summarize the overall design of the solution . Intrusion Detection Systems Detection Approach Systems Protected Architecture Data Sources Analysis Timing Detection Actions HIDS NIDS Hybrid Audit Logs Net Traffic System Stats Real Time Data Mining Anomaly Detection Signature Detection Centralized Distributed Active Passive Agent Based Next-Generation Fusion of IDS Sensor Functions

The Approach Summarize the overall design of the solution . 24 EVENT PRE-PROCESSING EVENT SOURCES EXTERNAL . . . LEVEL ONE EVENT TRACKING Visualization, BAM, User Interaction Event-Decision Architecture DB MANAGEMENT Historical Data Profiles & Patterns DISTRIBUTED LOCAL EVENT SERVICES . . EVENT PROFILES . . DATA BASES . . OTHER DATA LEVEL TWO SITUATION DETECTION LEVEL THREE PREDICTIVE ANALYSIS LEVEL FOUR ADAPTIVE BPM

The Approach Summarize the overall design of the solution . Flexible SOA and Event-Driven Architecture

The Approach - Phase I Event Sources and Commercial Products JAVA MESSAGING SERVICE (JMS) DISTRIBUTED QUEUES (TIBCO EMS) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE) HIGH PERFORMANCE RULES-ENGINE (TIBCO BE ) SENSOR NETWORK RULES NETWORK NIDS BW JMS LOGFILE JMS BW LOGFILE JMS BW LOGFILE JMS BW IDS JMS BW HIDS JMS BW SQL DB BW JMS ADB SQL DB BW JMS ADB MESSAGING NETWORK TIBCO PRODUCTS SOURCE SOURCE SOURCE SOURCE SOURCE SOURCE SOURCE SOURCE

The Approach Event Sources and Commercial Products ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Conclusions & Lesson Learned What Other Features Would Have Helped. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Thank You! Tim Bass, CISSP Principal Global Architect, Director [email_address] Event Processing at TIBCO

The Case Study Format ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Similar to Next-Generation IDS: A CEP Use Case in 10 Minutes

Detecting Opportunities and Threats with Complex Event Processing: Case St...

Tim Bass

Complex Event Processing (CEP) for Next-Generation Security Event Management,...

Tim Bass

Complex Event Processing

John Plummer

In this presentation we review the basic architecture behind SQL Server StreamInsight. Regards, Ing. Eduardo Castro Martínez, PhD – Microsoft SQL Server MVP http://mswindowscr.org http://comunidadwindows.org Costa Rica Technorati Tags: SQL Server LiveJournal Tags: SQL Server del.icio.us Tags: SQL Server http://ecastrom.blogspot.com http://ecastrom.wordpress.com http://ecastrom.spaces.live.com http://universosql.blogspot.com http://todosobresql.blogspot.com http://todosobresqlserver.wordpress.com http://mswindowscr.org/blogs/sql/default.aspx http://citicr.org/blogs/noticias/default.aspx http://sqlserverpedia.blogspot.com/

SQL Server 2008 R2 StreamInsight

Eduardo Castro

A Practical Guide to CMDB Deployment in a Tivoli Environment

Antonio Rolle

Log Analytics and Operational Intelligence for Distributed Microservices. IT systems and applications generate more and more distributed machine data due to millions of mobile devices, Internet of Things, social network users, and other new emerging technologies. However, organizations experience challenges when monitoring and managing their IT systems and technology infrastructure. They struggle with distributed Microservices and Cloud architectures, custom application monitoring and debugging, network and server monitoring / troubleshooting, security analysis, compliance standards, and others. This session discusses how to solve the challenges of monitoring and analyzing Terabytes and more of different distributed machine data to leverage the “digital business”. The main part of the session compares different open source frameworks and SaaS cloud solutions for Log Management and operational intelligence, such as Graylog , the “ELK stack”, Papertrail, Splunk or TIBCO LogLogic Unity). A live demo will demonstrate how to monitor and analyze distributed Microservices and sensor data from the “Internet of Things”. The session also explains the distinction of the discussed solutions to other big data components such as Apache Hadoop, Data Warehouse or Machine Learning, and how they can complement each other in a big data architecture. The session concludes with an outlook to the new, advanced concept of IT Operations Analytics (ITOA). Prsesn

Log Analytics for Distributed Microservices

Kai Wähner

NIST 800-92 Log Management Guide in the Real World

Anton Chuvakin

Leveraging Business Rules in TIBCO BusinessEvents

Tim Bass

DynaFlow is a leading provider of Governance, Risk and Compliance (GRC) / Enterprise Risk Management (ERM) and Workflow Automation Solutions (WFM). DynaFlow enables global companies to become “Simply in Control” by proactively managing enterprise risks, demonstrating compliance and automating and optimizing business processes. Established in 1997, DynaFlow pioneered in the area of Business Process Modeling and Knowledge Management and is dedicated to provide its clients a fast ROI through a short and structured implementation.

Overview of Dynaflow Solution

bpmgeek09

Actionable Insights - Thompson

Prolifics

Combating Fraud and Intrusion Threats with Event Processing

Tim Bass

Watch the full OnDemand Webcast: http://bit.ly/tuneupnetwork It’s time to make good on that new year’s resolution. Admit it, in a moment of weakness as the clock hit midnight you resolved to dig in and tune up your corporate network in the new year. Well, the new year is already passing quickly by, so if you haven’t yet made good on that resolution, here is your chance. In these slides from our web seminar, we return to the basics – overall network evaluation, baseline measurements and comparisons, typical yet troublesome network issues, sharing bandwidth in the presence of time-sensitive applications, security, and overall network monitoring and reporting, just to name a few. We focus on practical issues and practical methods for improving the overall health of your network. In these slides, we will cover: - Critical elements to consider when evaluating your network - Common pitfalls and how to avoid them - Developing and using network baselines - Optimizing network usage in the presence of competing applications and protocols - Monitoring and reporting on your well-tuned network What you will learn: 1. How and where to find the data you need 2. How to automate network monitoring and analysis to ensure the success of your tune up 3. How to quickly diagnose problems when things go wrong

Tune Up Your Network for the New Year

Savvius, Inc

Mit der Architektur steht und fällt jedes IT-Projekt. Das gilt in noch stärkerem Maße für Big-Data-Projekte, denn hier konnten noch keine Standards über Jahrzehnte ihre Tauglichkeit beweisen. Dennoch verbreiten und etablieren sich auch hier gute und effektive Lösungen. Der Vortrag erklärt, welche Bausteine wichtig für die verschiedenen Einsatzmöglichkeiten im Big-Data-Umfeld sind, und wie sie in konkrete Lösungen gegossen werden können. Dabei beleuchtet er sowohl traditionelle Big-Data-Architekturen als auch aktuelle Ansätze, wie z. B. die Lambda- und die Kappa-Architektur. Ebenfalls ein Thema sind Stream-Processing-Infrastrukturen und ihre Kombination mit Big-Data-Technologien. Ausgehend von einer produkt- und technologieunabhängigen Referenzarchitektur stellt dieser Vortrag verschiedene Lösungsmöglichkeiten auf Basis von Open-Source-Komponenten vor.

Big Data Architectures @ JAX / BigDataCon 2016

Guido Schmutz

TechEd - 2008 : BizTalk RFID PPT

Sudhir Hasbe

CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)

CISQ - Consortium for IT Software Quality

Turning Insight Into Action With Cics Events

CICS ROADSHOW

Business cases for software security

Marco Morana

PCI 2.0 What's Next for PCI DSS by Dr. Anton Chuvakin

Anton Chuvakin

Security threat analysis points for enterprise with oss

Hibino Hisashi

Event Driven Architecture (EDA), November 2, 2006

Tim Bass

Similar to Next-Generation IDS: A CEP Use Case in 10 Minutes (20)

Detecting Opportunities and Threats with Complex Event Processing: Case St...

Complex Event Processing (CEP) for Next-Generation Security Event Management,...

Complex Event Processing

SQL Server 2008 R2 StreamInsight

A Practical Guide to CMDB Deployment in a Tivoli Environment

Log Analytics for Distributed Microservices

NIST 800-92 Log Management Guide in the Real World

Leveraging Business Rules in TIBCO BusinessEvents

Overview of Dynaflow Solution

Actionable Insights - Thompson

Combating Fraud and Intrusion Threats with Event Processing

Tune Up Your Network for the New Year

Big Data Architectures @ JAX / BigDataCon 2016

TechEd - 2008 : BizTalk RFID PPT

CISQ and Software Quality Measurement - Software Assurance Forum (March 2010)

Turning Insight Into Action With Cics Events

Business cases for software security

PCI 2.0 What's Next for PCI DSS by Dr. Anton Chuvakin

Security threat analysis points for enterprise with oss

Event Driven Architecture (EDA), November 2, 2006

Recently uploaded

Tata AIG General Insurance Company - Insurer Innovation Award 2024

The Digital Insurer

Presentation on how to chat with PDF using ChatGPT code interpreter

naman860154

Enterprise Knowledge’s Urmi Majumder, Principal Data Architecture Consultant, and Fernando Aguilar Islas, Senior Data Science Consultant, presented "Driving Behavioral Change for Information Management through Data-Driven Green Strategy" on March 27, 2024 at Enterprise Data World (EDW) in Orlando, Florida. In this presentation, Urmi and Fernando discussed a case study describing how the information management division in a large supply chain organization drove user behavior change through awareness of the carbon footprint of their duplicated and near-duplicated content, identified via advanced data analytics. Check out their presentation to gain valuable perspectives on utilizing data-driven strategies to influence positive behavioral shifts and support sustainability initiatives within your organization. In this session, participants gained answers to the following questions: - What is a Green Information Management (IM) Strategy, and why should you have one? - How can Artificial Intelligence (AI) and Machine Learning (ML) support your Green IM Strategy through content deduplication? - How can an organization use insights into their data to influence employee behavior for IM? - How can you reap additional benefits from content reduction that go beyond Green IM?

Driving Behavioral Change for Information Management through Data-Driven Gree...

Enterprise Knowledge

Advantages of Hiring UIUX Design Service Providers for Your Business

Pixlogix Infotech

MySQL Webinar, presented on the 25th of April, 2024. Summary: MySQL solutions enable the deployment of diverse Database Architectures tailored to specific needs, including High Availability, Disaster Recovery, and Read Scale-Out. With MySQL Shell's AdminAPI, administrators can seamlessly set up, manage, and monitor these solutions, ensuring efficiency and ease of use in their administration. MySQL Router, on the other hand, provides transparent routing from the application traffic to the backend servers in the architectures, requiring minimal configuration. Completely built in-house and supported by Oracle, these solutions have been adopted by enterprises of all sizes for their business-critical applications. In this presentation, we'll delve into various database architecture solutions to help you choose the right one based on your business requirements. Focusing on technical details and the latest features to maximize the potential of these solutions.

Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...

Miguel Araújo

This presentations targets students or working professionals. You may know Google for search, YouTube, Android, Chrome, and Gmail, but did you know Google has many developer tools, platforms & APIs? This comprehensive yet still high-level overview outlines the most impactful tools for where to run your code, store & analyze your data. It will also inspire you as to what's possible. This talk is 50 minutes in length.

Powerful Google developer tools for immediate impact! (2023-24 C)

wesley chun

The 7 Things I Know About Cyber Security After 25 Years | April 2024

Rafal Los

Imagine a world where information flows as swiftly as thought itself, making decision-making as fluid as the data driving it. Every moment is critical, and the right tools can significantly boost your organization’s performance. The power of real-time data automation through FME can turn this vision into reality. Aimed at professionals eager to leverage real-time data for enhanced decision-making and efficiency, this webinar will cover the essentials of real-time data and its significance. We’ll explore: FME’s role in real-time event processing, from data intake and analysis to transformation and reporting An overview of leveraging streams vs. automations FME’s impact across various industries highlighted by real-life case studies Live demonstrations on setting up FME workflows for real-time data Practical advice on getting started, best practices, and tips for effective implementation Join us to enhance your skills in real-time data automation with FME, and take your operational capabilities to the next level.

From Event to Action: Accelerate Your Decision Making with Real-Time Automation

Safe Software

CNv6 Instructor Chapter 6 Quality of Service

giselly40

Data Cloud, More than a CDP by Matt Robison

Anna Loughnan Colquhoun

BooK Now Call us at +918448380779 to hire a gorgeous and seductive call girl for sex. Take a Delhi Escort Service. The help of our escort agency is mostly meant for men who want sexual Indian Escorts In Delhi NCR. It should be noted that any impersonator will get 100 attention from our Young Girls Escorts in Delhi. They will assume the position of reliable allies. VIP Call Girl With Original Photos Book Tonight +918448380779 Our Cheap Price 1 Hour not available 2 Hours 5000 Full Night 8000 TAG: Call Girls in Delhi, Noida, Gurgaon, Ghaziabad, Connaught Place, Greater Kailash Delhi, Lajpat Nagar Delhi, Mayur Vihar Delhi, Chanakyapuri Delhi, New Friends Colony Delhi, Majnu Ka Tilla, Karol Bagh, Malviya Nagar, Saket, Khan Market, Noida Sector 18, Noida Sector 76, Noida Sector 51, Gurgaon Mg Road, Iffco Chowk Gurgaon, Rajiv Chowk Gurgaon All Delhi Ncr Free Home Deliver

08448380779 Call Girls In Greater Kailash - I Women Seeking Men

Delhi Call girls

Heather Hedden, Senior Consultant at Enterprise Knowledge, presented “The Role of Taxonomy and Ontology in Semantic Layers” at a webinar hosted by Progress Semaphore on April 16, 2024. Taxonomies at their core enable effective tagging and retrieval of content, and combined with ontologies they extend to the management and understanding of related data. There are even greater benefits of taxonomies and ontologies to enhance your enterprise information architecture when applying them to a semantic layer. A survey by DBP-Institute found that enterprises using a semantic layer see their business outcomes improve by four times, while reducing their data and analytics costs. Extending taxonomies to a semantic layer can be a game-changing solution, allowing you to connect information silos, alleviate knowledge gaps, and derive new insights. Hedden, who specializes in taxonomy design and implementation, presented how the value of taxonomies shouldn’t reside in silos but be integrated with ontologies into a semantic layer. Learn about: - The essence and purpose of taxonomies and ontologies in information and knowledge management; - Advantages of semantic layers leveraging organizational taxonomies; and - Components and approaches to creating a semantic layer, including the integration of taxonomies and ontologies

The Role of Taxonomy and Ontology in Semantic Layers - Heather Hedden.pdf

Enterprise Knowledge

Building Digital Trust in a Digital Economy Veronica Tan, Director - Cyber Security Agency of Singapore Apidays Singapore 2024: Connecting Customers, Business and Technology (April 17 & 18, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...

apidays

Handwritten Text Recognition for manuscripts and early printed texts

Maria Levchenko

Histor y of HAM Radio presentation slide

vu2urc

With more memory available, system performance of three Dell devices increased, which can translate to a better user experience Conclusion When your system has plenty of RAM to meet your needs, you can efficiently access the applications and data you need to finish projects and to-do lists without sacrificing time and focus. Our test results show that with more memory available, three Dell PCs delivered better performance and took less time to complete the Procyon Office Productivity benchmark. These advantages translate to users being able to complete workflows more quickly and multitask more easily. Whether you need the mobility of the Latitude 5440, the creative capabilities of the Precision 3470, or the high performance of the OptiPlex Tower Plus 7010, configuring your system with more RAM can help keep processes running smoothly, enabling you to do more without compromising performance.

Boost PC performance: How more available memory can improve productivity

Principled Technologies

Scaling API-first – The story of a global engineering organization

Radu Cotescu

Created by Mozilla Research in 2012 and now part of Linux Foundation Europe, the Servo project is an experimental rendering engine written in Rust. It combines memory safety and concurrency to create an independent, modular, and embeddable rendering engine that adheres to web standards. Stewardship of Servo moved from Mozilla Research to the Linux Foundation in 2020, where its mission remains unchanged. After some slow years, in 2023 there has been renewed activity on the project, with a roadmap now focused on improving the engine’s CSS 2 conformance, exploring Android support, and making Servo a practical embeddable rendering engine. In this presentation, Rakhi Sharma reviews the status of the project, our recent developments in 2023, our collaboration with Tauri to make Servo an easy-to-use embeddable rendering engine, and our plans for the future to make Servo an alternative web rendering engine for the embedded devices industry. (c) Embedded Open Source Summit 2024 April 16-18, 2024 Seattle, Washington (US) https://events.linuxfoundation.org/embedded-open-source-summit/ https://ossna2024.sched.com/event/1aBNF/a-year-of-servo-reboot-where-are-we-now-rakhi-sharma-igalia

A Year of the Servo Reboot: Where Are We Now?

Igalia

GenCyber Cyber Security Day Presentation

Michael W. Hawkins

The presentation explores the development and application of artificial intelligence (AI) from its inception to its current status in the modern world. The term "artificial intelligence" was first coined by John McCarthy in 1956 to describe efforts to develop computer programs capable of performing tasks that typically require human intelligence. This concept was first introduced at a conference held at Dartmouth College, where programs demonstrated capabilities such as playing chess, proving theorems, and interpreting texts. In the early stages, Alan Turing contributed to the field by defining intelligence as the ability of a being to respond to certain questions intelligently, proposing what is now known as the Turing Test to evaluate the presence of intelligent behavior in machines. As the decades progressed, AI evolved significantly. The 1980s focused on machine learning, teaching computers to learn from data, leading to the development of models that could improve their performance based on their experiences. The 1990s and 2000s saw further advances in algorithms and computational power, which allowed for more sophisticated data analysis techniques, including data mining. By the 2010s, the proliferation of big data and the refinement of deep learning techniques enabled AI to become mainstream. Notable milestones included the success of Google's AlphaGo and advancements in autonomous vehicles by companies like Tesla and Waymo. A major theme of the presentation is the application of generative AI, which has been used for tasks such as natural language text generation, translation, and question answering. Generative AI uses large datasets to train models that can then produce new, coherent pieces of text or other media. The presentation also discusses the ethical implications and the need for regulation in AI, highlighting issues such as privacy, bias, and the potential for misuse. These concerns have prompted calls for comprehensive regulations to ensure the safe and equitable use of AI technologies. Artificial intelligence has also played a significant role in healthcare, particularly highlighted during the COVID-19 pandemic, where it was used in drug discovery, vaccine development, and analyzing the spread of the virus. The capabilities of AI in healthcare are vast, ranging from medical diagnostics to personalized medicine, demonstrating the technology's potential to revolutionize fields beyond just technical or consumer applications. In conclusion, AI continues to be a rapidly evolving field with significant implications for various aspects of society. The development from theoretical concepts to real-world applications illustrates both the potential benefits and the challenges that come with integrating advanced technologies into everyday life. The ongoing discussion about AI ethics and regulation underscores the importance of managing these technologies responsibly to maximize their their benefits while minimizing potential harms.

Artificial Intelligence: Facts and Myths

Joaquim Jorge

Recently uploaded (20)