## 7 Discussion  
The proposed platform processes events received by multiple sources, and generates security alarms accordingly. It is important to highlight that only with the logs provided by one security sensor (e.g., an IDS), CLAP can correlate events and produce alarms to indicate the presence of a threat or an attack in the monitored system. However, as a cross-layer platform, CLAP can correlate events coming from different sources (e.g., NTSA, JDet, IDS, etc.), which will result into alarms with higher impact values and more reliable values (e.g., low levels of false-positive and -negative rates).  
Using the built-in SIEM features, CLAP can correlate events coming from the system logs (IDS installed in the end-user infrastructure) with information from the network traffic (generated by the NTSA tool) and information from other security sensors related to jamming signals (JDet).  
Security alarms generated in the platform are shared with the Real-time anomaly detector (RTAD) via RabbitMQ for further analysis. Alarms are also displayed in the platform's dashboard with the following format:  
**<Signature; Events; Risk; Duration; Source; Destination; Status>**  
Examples of the security alarms generated by CLAP are given bellow:  
* Policy violation; 3; 3; 0 secs; 192.168.66.5:39058; 192.168.66.6:http; open
* Jammer detector; 2; 5; 0 secs; 172.16.4.235:ANY; 192.168.66.6:ANY; open
* L-ADS ERROR: Abnormal observation on DST_IP; 2; 4; 0 secs; 192.168.66.5:ANY; 192:168.66:6:ANY; open
* Unauthorized PLC data modification; 2; 5; 0 secs; 192.168.66.5:32907; 192.168.66.6:asa-appl-proto; open  
In the previous examples we have several alarms that correlates 2 or more events affecting the same IP source and/or destination within a given period of time. In each alarm there is an indication of the incident (signature), the number of correlated events, the severity level associated with the alarm, the duration of the events in seconds (from the first to the last detected event), the IP source and destination, port source and destination, as well as protocols involved, and the status of the alarm (open/close).  
It is important to note that the strength of the proposed solution lies in its correlation engine. In this particular example, a policy violation against IP address 192.168.66.6 has been detected by an IDS, the NTSA detects an error on the same IP, indicating an abnormal behavior of this resource and the JDet identifies a jamming signal where the target IP is involved.The platform correlates all these alarms and automatically generate a cross-correlated alarm with a higher severity level.  
Considering the information from the individual alarms, their severity ranges from 3 (low) to 6 (medium). They have been generated based on events simultaneously detected by three distinct data sources (i.e., Suricata, NTSA, and JDet), making it possible to correlate them based on the destination IP address. As a result, the following cross-correlated alarm has been generated.  
Multiple attacks against IP_DST; 5; 8; 60 secs; 192.168.66.5:ANY; 192.168.66.6:ANY; open  
It is important to highlight that the previous alarm has a high severity level (equivalent to 8), which places this alarm in the top of the priorities to be treated by the security analysts. Using cross-correlation rules, we reduce the amount of information (keeping only the most valuable data to the security administrator), which in turns improves the analysis and decision-making process. In addition, more accurate responses (with higher confidence) can be obtained in real time (or near real time), generally within a few seconds. Furthermore, false rates are considerably reduced, as different data sources point to the same incident and the probability of generating false alarms is very low. As a result, the detection of complex attacks is greatly improved by adding events from a variety of data sources.