DETECTING THE INFORMATION SECURITY ANOMALIES BASED ON AN ENTROPY ANALYSIS OF THE INFORMATION SYSTEM

Abstract

Measures to protect against cyberattacks are unable to provide a 100% guarantee that an attacker cannot penetrate an information system. If an attacker has gained access to the system, then such actions should be detected as soon as possible and interrupt access, as well as an investigation to fix security gaps. Methods used to detect attacks are divided into detecting misuse and detecting anomalies. This paper investigates the applicability of a frequency method that detects anomalies in the system by analyzing the entropy of the event log. This method is typically used to detect anomalies in network traffic, and unauthorized activities can also be indicated by anomalies in the hosts' event log. Studies on the Windows event log have shown that by analyzing the entropy, it is possible to detect exceeding the security thresholds by the number of different messages in the event log. This may indicate anomalies in the operation of the information system. The proposed method can be integrated into intrusion detection systems that notify the security administrator of possible violations.