报告详情
SECURE-RCA: Evidence-Guided Cybersecurity Incident Investigation and Root Cause Analysis
编号：54
访问权限：仅限参会人
更新：2026-11-10 16:33:04 浏览：8次
In-person
报告开始：2026年11月20日 14:15（Asia/Kolkata）
报告时间：15min
所在会场：[S7] Networking, Security and Blockchain Systems [S7-1] Networking, Security and Blockchain Systems
暂无文件
摘要
Many security events are detected by security event detectors; thus, it is necessary to relate events with the associated process activities before starting an investigation of incidents. Larger windows can result in grouping unrelated events, while smaller windows can split related process activities, leading to the inaccurate correlation. While contextual information and process lineage can help event correlation, evidence from the endpoint telemetry may not always be sufficient for determining parent-child process relations. The paper entitled "SECURE-RCA: Evidence-Guided Cybersecurity Incident Investigation and Root Cause Analysis" examines the effect of temporal proximity, contextual attributes, and availability of evidence on parent-process candidates' selection using Windows endpoint telemetry. It considers fixed-time-window correlation behavior, contextual consistency between parent-child process pairs, and consideration of hard non-parent candidates that are temporally possible but are not parents of child processes. To assess candidates for parent processes, a Random Forest classifier is constructed based on temporal gaps, matching of contextual attributes, and availability of evidence. Evaluation of the model is done using child-grouped cross-validation in order to prevent data leakage from training to test sets. In addition to that, the ablation study assesses the separate effect of each of the aforementioned feature groups in identifying candidates for parent-child process relations. It can be seen from the results that the integration of temporal and contextual evidence is crucial when looking for potential parent-child process relations.
关键词
security event correlation,process lineage,parent-process candidate selection,contextual evidence,endpoint telemetry,Random Forest
报告人
SARANYA S
Student Sri Sairam Engineering College, Chennai稿件作者
全部评论
重要日期
-
会议日期
11月20日
2026
至11月22日
2026
-
10月31日 2026
初稿截稿日期
-
11月07日 2026
提前注册日期
-
11月22日 2026
注册截止日期
主办单位
United Societies of Science
承办单位
Pondicherry University
协办单位
IEEE Section
IEEE Madras Section
IEEE Madras Section
联系方式
- ICon INDIA 2026
- ic******@usssociety.org
发表评论