Improving SIEM capabilities through an enhanced probe for encrypted Skype traffic detection

TL;DR

This paper presents an improved SIEM system with an enhanced probe, ESkyPRO, leveraging machine learning to accurately detect encrypted Skype traffic by correlating data from multiple sources.

Contribution

The authors develop a novel enhanced probe, ESkyPRO, integrated into SIEM systems, utilizing machine learning to improve detection of encrypted Skype traffic.

Findings

ESkyPRO improves detection accuracy of encrypted Skype traffic.

Correlation of multiple data sources enhances detection reliability.

Machine learning techniques contribute to the system's effectiveness.

Abstract

Nowadays, the Security Information and Event Management (SIEM) systems take on great relevance in handling security issues for critical infrastructures as Internet Service Providers. Basically, a SIEM has two main functions: i) the collection and the aggregation of log data and security information from disparate network devices (routers, firewalls, intrusion detection systems, ad hoc probes and others) and ii) the analysis of the gathered data by implementing a set of correlation rules aimed at detecting potential suspicious events as the presence of encrypted real-time traffic. In the present work, the authors propose an enhanced implementation of a SIEM where a particular focus is given to the detection of encrypted Skype traffic by using an ad-hoc developed enhanced probe (ESkyPRO) conveniently governed by the SIEM itself. Such enhanced probe, able to interact with an agent counterpart deployed into the SIEM platform, is designed by exploiting some machine learning concepts. The main purpose of the proposed ad-hoc SIEM is to correlate the information received by ESkyPRO and other types of data obtained by an Intrusion Detection System (IDS) probe in order to make the encrypted Skype traffic detection as accurate as possible.