TY  - JOUR
T1  - A User and Entity Behavior Analysis for SIEM Systems: Preprocessing of The Computer Emergency and Response Team Dataset
AU  - Görmez, Yasin
AU  - Arslan, Halil
AU  - Işık, Yunus Emre
AU  - Dadaş, İbrahim Ethem
PY  - 2023
DA  - June
DO  - 10.55195/jscai.1213782
JF  - Journal of Soft Computing and Artificial Intelligence
JO  - JSCAI
PB  - Mahmud ASİLSOY
WT  - DergiPark
SN  - 2717-8226
SP  - 1
EP  - 6
VL  - 4
IS  - 1
LA  - en
AB  - A lot of work has been done to prevent attacks from external sources and a great deal of success has been achieved. However, studies to detect internal attacks aren’t sufficient today. One of the most important studies for the detection of insider attacks is User and Entity Behavior Analysis (UEBA). In this letter, UEBA studies in the literature were reviewed and The Computer Emergency and Response Team Dataset was analyzed (CERT). For this purpose, preprocessing and feature extraction steps were applied on CERT datasets. Several log files combined with respect to user and for each user the number of activities in the specified time interval were obtained. The python code of these preprocessing and feature extraction steps were shared as open source in GitHub platform. In the final phase, future analysis was described and UEBA system planned to be designed was explained.
KW  - User and Entity Behavior Analysis 
Preprocessing
Classification 
CERT 
Security Information and Event Management
KW  - Preprocessing
KW  - Classification
KW  - CERT
KW  - Security Information and Event Management
UR  - https://doi.org/10.55195/jscai.1213782
L1  - https://dergipark.org.tr/en/download/article-file/2809492
ER  -