Search

Search Results

• SCENARIO- AND RISK-WEIGHTED LOGGING DEFICIT METHODOLOGY FOR SIEM WITH A PROBABILISTIC INTENSITY BASELINE AND ASSESSMENT OF EVENT SUITABILITY FOR CORRELATION

  М. А. Kiselev

  68-83

  2026-07-07

  Abstract ▼

  Relevance. The effectiveness of correlation in SIEM is determined not only by the completeness of incoming events, but also by their suitability for scenario-based analysis. Practical logging defects, including under-logging, violations of temporal consistency, loss of mandatory attributes, and record duplication, degrade detection quality and increase the likelihood of false positives. Objective. To develop a scenario- and risk-weighted methodology for the quantitative assessment of logging deficit as a measure of the suitability of an event stream for correlation. Tasks. To form a scenario-justified set of controlled event classes, assign risk weights to them, construct a probabilistic baseline intensity profile, introduce criteria of temporal validity and structural suitability of records, and obtain an integral indicator with diagnostic interpretation of the causes of logging quality degradation. Methods. The study employs scenario analysis of detection content, risk-weighted aggregation, baseline construction from historical data, monitoring of event temporal validity, and assessment of the completeness of minimally sufficient profiles of correlation-significant attributes. Results. The proposed method extends the basic logging deficit indicator by introducing a probabilistic baseline intensity profile, sensitivity to over-logging, loss of correlation-significant fields, and a diagnostic decomposition of logging quality degradation causes. Experimental validation showed that in the baseline mode, DL_new = 0.000 while DL_old = 0.297, confirming the absence of false positives produced by the new indicator on a normal event stream. In the duplication scenario, DL_old = 0.000 while DL_new = 0.073, demonstrating the ability of the new inidcator to detect over-logging that remains invisible to the basic indicator. When temporal consistency is violated, all indicators reach 1.000, which corresponds to the complete unsuitability of the event stream for correlation. Conclusions and significance. The scientific novelty lies in the formalization of logging deficit as a deficit of event-stream suitability for correlation, taking into account the scenario significance of event classes and introducing a diagnostic decomposition that makes it possible to identify the dominant diagnostic component of degradation. The practical significance lies in the ability to quantitatively justify priority measures for improving event sources, normalization procedures, and correlation rules in SIEM.