METHOD FOR FAST FILTERING OF DATA SETS ON COMPUTER INCIDENTS OF INFORMATION SECURITY Russian patent published in 2024 - IPC G06F21/55 

FIELD: computer security.

SUBSTANCE: invention relates to methods of fast filtering of data arrays in systems of security information and event management (SIEM) class on information security incidents, and can be used as a function of cross-correlation of information security events. Technical result is achieved by implementing a method for fast filtering of data sets on computer incidents of information security, in which event data are broken down into those which satisfy common rules designed to detect common, uniquely threatening information security situations, and which satisfy cross-correlation rules; event data which satisfy the cross-correlation rules are subjected to field and row filtering, normalization and sorting by time, loaded into the computer RAM and processed by the cross-correlation rule; when the cross-correlation rule is met, an information security incident is detected.

EFFECT: faster method of filtering data sets on computer incidents of information security in SIEM class systems.

1 cl, 1 dwg