Cyber defence using automatic event correlation for detection of abnormalities

The Austrian Instiute of Technology AIT experts are working on leading- edge technologies and solutions based on novel machine-learning concepts for the future cyber defence ecosystems. The aim is to tackle cyber threats within comprehensive ICT networks, due to their increasing interconnectedness and unclear attack surfaces. The tool AECID stands for Automatic Event Correlation for Incident Detection and is an intelligent cyber security tool that uses special mathematical calculations to distinguish abnormalities from normal behavior in complex computer networks. It will be applied in the field of blockchain technologies to provide insight into functionality and transaction flows for the real-time analysis of virtual currency transactions. A particular focus lies in the detection of „anomalies“ , i.e. the identification of transactions and transaction patterns that deviate from the usual structures. The patented solution AECID builds upon system behaviour models to understand relevant events and their inter-relationship. It is created as a self-learning solution for adaptive networks. Log stream processing can help to detect, classify and cluster frequently occurring patterns in log files and events, and to eventually distinguish good from unknown malicious activities in the IT infrastructures of enterprises.

• In contrast to conventional systems, the algorithm does not need specific knowledge about the IT systems to be monitored. Rather, a pure pattern recognition after appropriate observation and study time by a self-learning algorithm is conducted.
• As a result, AIT´s AECID technology continuously adapts to new situations and does not require any elaborate specification of the technical system and no complex "configuration management" by the operator.
• By constantly gathering and analyzing new information, AECID independently and continuously enhances and refines its own knowledge base for new insights into the system in which it is used.