EXEHDA-USM: uma arquitetura hierárquica multinível ciente de situação aplicada a segurança da informação

Abstract

Concern about information security in companies has increased in recent years, and this is a natural consequence from the increase in the number of incidents and from the financial losses arising. Given this scenario, organizations often implement special-purpose technologies to promote the security of their systems, however, they do not provide an environmental vision as a whole. With this, Situation Awareness concepts have been applied in computer network security to providing a full view of the security of computing infrastructures. This union between areas remains focus of study and research due to factors such as the intensification possibility of unauthorized access; the increasing use of distributed resources; heterogeneity and the number of independent devices that generate a considerable volume of data in different formats. Thus, the main objective of this paper is to present the conception of an approach denominated Execution Environment for Highly Distributed Applications - Unified Security Management (EXEHDA-USM) aimed at providing Situation Awareness on issues related to information security of computing environments by means of a multilevel hierarchical architecture based on scalability, flexibility, heterogeneity and autonomy. The approach conceived had as key assumptions: (a) a distributed architecture that exploits resources to context awareness from the collect, through processing, contextual data storage and the consequent actuations; use of a strategy with an alternative syntax to regular expressions for both (b) normalization of events in the pre-processing step, and (c) detection of situations of interest in both cases aiming a better readability and facility in creation and adaptation of existing expressions. The tests developed through case studies inspired by the computing environment of the Federal University of Pelotas showed that the approach conceived has flexible and scalable character, offering autonomy to its components, being able to operate in today’s distributed and heterogeneous environments.