CURRENT STATUS AND DIRECTIONS FOR IMPROVING METHODS FOR DETECTING INFORMATION SECURITY INCIDENTS

Valeev Mikhail Vladimirovich

The article proposes to consider the issues of unauthorized access to protected information in a local area network, the development of attack methods and the current state of intrusion detection systems at the network level. The paper considers the features of using the SIEM information security event collection and correlation system and the need to improve information protection methods. In this paper, the author presents an analysis of the main advantages and disadvantages of systems for preventing possible information security incidents and fulfilling state requirements in the field of protecting critical information infrastructure. In the course of the study, methods for detecting intrusions in the corporate segment of an information system are presented, models of a network and host intrusion detection system are presented. By classifying information security events received from various systems, it is possible to draw a conclusion about the state of the entire protected object in real time.

Keywords:intrusion detection system, information security, unauthorized access, information security software, SIEM systems methodology, source of information security events, behavioral analysis