# A Study on a Scenario-Based Security Incident Prediction System for Cybersecurity
## 3 Existing Security Incidents and Limitations of Security Products
### Limitations of Traditional Integrated Security Products and Common Security Vulnerabilities  
SIEM (Security Information and Event Management) and ESM (Enterprise Security Management) are capable of centrally managing security threat information collected from individual security products [15]. However, it is challenging to quantitatively assess security incidents on an enterprise-wide scale [16]. This difficulty is further exacerbated by the heavy reliance on the capabilities of information security personnel, making it hard to assess the increasing likelihood of security incidents. Below, Table 2 outlines the functions and usage of SIEM and ESM, highlighting their distinctions. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Victim** & **Nation** & **Year** & **Attack Method** \\ \hline Colonial Pipeline & USA & 2021 & Ransomware (Darsside) \\ \hline Sol Oriens & USA & 2021 & Ransomware (REvil) \\ \hline JBS Foods & USA & 2021 & Ransomware (REvil) \\ \hline Honda & Japan & 2020 & Ransomware (EKANS) \\ \hline Norsk Hydro & Norway & 2019 & Ransomware (LockerGoga) \\ \hline Lake City & USA & 2019 & Ransomware (Ryuk) \\ \hline Wood Ranch Medical & USA & 2019 & Ransomware \\ \hline Saudi Arabia petrochemical plant & Saudi & 2017 & APT Attack \\ \hline Ukrainian region power supply & & 2015/2016 & APT Attack (Black Energy) \\ company & & 2010 & APT Attack (Stuxnet) \\ \hline Iran Bucer Nuclear Power Plant & Iran & 2010 & APT Attack (Stuxnet) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Cases of cyber infringement incidents related to ICS and OT. While Table 2 outlines the functions and usage of SIEM and ESM, it also highlights their inherent weaknesses, which limit their effectiveness in modern cybersecurity environments. One significant limitation of SIEM systems is their heavy reliance on structured data for analysis. As organizations increasingly adopt cloud-based services, IoT devices, and other emerging technologies, the volume of unstructured or semi-structured log data continues to grow. SIEM systems often lack the capability to effectively process and analyze this type of data, resulting in blind spots that can be exploited by sophisticated attackers. Additionally, the dependency on predefined correlation rules and manual input from security personnel further restricts their ability to scale and respond dynamically to evolving threats. This reactive nature makes it challenging to detect novel attack patterns, such as zero-day vulnerabilities or multi-vector threats. ESM systems, while designed to centralize security monitoring, share similar limitations. They rely on manual efforts to consolidate and analyze security threat information, which can delay detection and response times. Their focus on real-time monitoring of specific network threats often leads to a narrow scope of analysis, leaving broader attack patterns undetected. Furthermore, ESM systems are constrained by their compatibility with structured log data, which reduces their ability to incorporate diverse data formats generated by modern security infrastructures. Both systems face challenges in integrating with legacy platforms, which frequently use proprietary log formats or outdated protocols. This lack of seamless integration hampers the comprehensive visibility required for effective threat management. Moreover, the overwhelming volume of logs and security events processed by these systems often results in high rates of false positives and negatives. This not only burdens security teams but also increases the likelihood of critical threats being overlooked amidst the noise. These weaknesses necessitate a paradigm shift in how security incidents are predicted and managed. The traditional reliance on manual processes and reactive methodologies must be replaced with proactive, automated systems capable of handling the complexity and scale of modern cyber threats.