SIEM Cyber Range: Security Information and Event Management(SIEM) Range based on Cyber Kill Chain

• Main Authors: Chih-Hsiang Lu, 呂智翔
• Other Authors: 許振銘
• Format: Others
• Language: zh-TW
• Published: 2018
• Online Access: http://ndltd.ncl.edu.tw/handle/8uhfrv

碩士 === 健行科技大學 === 資訊工程系碩士班 === 106 === As time goes by, Internet is the Infrastructure that everyone can easily access nowadays. Along with the convenience, Internet also brings the opportunity to people who try to do evil. Cyber-attack have been on the rise in recent years and many security related devices are built to help people defend against them. However, hacker is never stopping looking for the vulnerability of those IT devices. Cyber kill chain is the description to illustrate each step and show how it works during the whole attack process. A cyber security Capture The Flag (CTF) competition is an interesting way to attract the attention to people. By a series of knowledge and skill testing, it makes people realize the importance of information security. It is used as a learning tool for everyone that is interested in cyber security. However, it also makes people only focus on the individual part of attack. Consequently, it is difficult to learn the whole picture regarding entire incident event during the competition. Advanced Persistent Threat (APT) attracts lots of attention in recent years. Previous research has confirmed that it takes hundreds of days for people to realize the IT environment has been compromised by APT. Cyber Kill Chain Range (kRange) is a platform to demonstrate the intrusion step launched like by APT. In order to avoid misuse of kRange, the thesis use it as a foundation and develop the platform to collect all the data from front-end security device, and then demonstrate the intrusion steps automatically. The proposed platform is able to help people who is in the beginning stage learn the concept of each intrusion step from IR (Incident Response) point of view.With the proper design of hints during competition, the proposed platform is able to bring the information security idea to each participant.