Anomaly Detection in SIEM Systems: Identifying Threats Through Advanced Analytics

Abstract

Security Information and Event Management (SIEM) systems play a critical role in enhancing an organization’s cybersecurity posture by providing a centralized platform for log collection, analysis, and event management. With the increasing complexity of cyber threats and the sheer volume of data generated, traditional rule-based detection mechanisms are becoming inadequate. This paper discusses advanced analytics techniques in anomaly detection within SIEM systems, focusing on their effectiveness in identifying potential threats that deviate from normal operational patterns. We explore various methods, including statistical analysis, machine learning, and deep learning, and examine their applications, challenges, and future directions. The paper emphasizes the importance of integrating these advanced analytics techniques to improve the detection rate of genuine threats while minimizing false positives.