Data collection for information security system

摘要

The security of information systems is generally related to the deployed tools to protect the network infrastructure from attacks. These latter are based on detection components that analyze the information transmitted through the network. The existing systems do not provide a full protection and present a high rate of false positives that could result from a lack in the analysis of the collected information (events). Thus, useful information should be determined to perform accurate detection and hence perform good protection. In this paper, a new approach to collect useful data from the network is proposed. It is based on new components called: observers. The system architecture is presented and the different components are described in details. Furthermore, the functioning of the different parts of the system is discussed.