RaSIEM 2013 - The 2nd International Workshop on Recent Advances in Security Information and Event Management (RaSIEM 2013)

Management of events and incidents is one of the cornerstones for any service. Traditionally, event management frameworks are reactionary. The SIEM (Security Information and Event Management) approach enables near-real time event management as well as proactive management of security incidents and events for IT infrastructures. However, the SIEM solutions available commercially are not able to interpret high-level data from such as the service view or the business impact view. Another limitation of SIEMs is related to scalability. Indeed, current solutions are limited since they depend on centralized rule processing performed on a single node.
One of the most challenging domains for SIEMs, but not only, is the protection of critical infrastructures. Over the last few years, there has been growing understanding of security risks related to (targeted) cyber attacks against critical infrastructures in all sectors (dams, energy, transport, etc.). Critical infrastructure networks are very different in comparison to other IT infrastructures. Most of the endpoint actors are machines rather than people, their malfunction can have immediate physical consequences, and they are more likely to be targeted by malicious adversaries. The protection of these networks faces several challenges, such as:
Recognizing real threats in the multitude of daily alerts.
Ensuring data source reliability.
Managing data from heterogeneous devices and networks.
Correlation of highly heterogeneous data to identify threats.
Ensuring the resilience against all hazards;
The workshop will present technical and practical results of EU FP7 MASSIF project partners and those of invited presenters working in related fields.
The workshop aim is to discuss hot topics and demonstrate advances in the field of Security Information and Event Management (SIEM). We intend to bring together contributors of the EU FP7 MASSIF project as well as external researchers working in this area to present and discuss their recent results. We therefore expect this workshop to give an extensive insight into the state-of-the-art and novel perspectives of SIEM technologies.
The goal of the EU FP7 MASSIF project (http://www.massif-project.eu/) is to provide a new SIEM framework for service infrastructures supporting intelligent, scalable, and multi-level/multi-domain security event processing and predictive security monitoring as well as decision support.
Topics of interest comprise but are not limited to:
Case study of SIEM in operational scenarios (Olympic games, critical infrastructures such as dams, mobile money transfer service, enterprise service infrastructures)
SIEM for distributed computing
Fault tolerance for SIEM
Security analysis for SIEM
Workflow monitoring for SIEM
Decision systems in SIEM
Event translation for SIEM
Event processing for SIEM