Architecture for detecting violations of security policies using the ABD method

Abstract

Logs are highly relevant in managing computer security because the information recorded in them contributes to auditing and forensic analysis activities. Among the logs associated with safety are those generated by access to network services, specifically the Internet through a proxy. Because of the constant transformation of computer systems and the emergence of automatic tools to manage logs, it is necessary to integrate the functionalities of software architectures with the computer security requirements defined in the organization. This article analyzes the different architectural design methods to determine the structure of its components, their relationships, and the principles and guidelines that make up the architecture. In addition, it will allow the implementation of security mechanisms and functions that will be supported by mechanisms that will determine the quality of the proposed architecture. An architecture is offered for the detection of security breaches from the analysis of internet browsing logs of users, based on the ABD method (Architecture-Based Design Method) and the systems security architecture of information proposed by the SANS Institute for the design and description of the architecture components.