# Evaluation of Local Security Event Management System vs. Standard Antivirus Software
## 3 Methodology and Implementation
### Related Work
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**MITRE ATT&CK** & **Cyber Kill Chain** & \
\begin{tabular}{c} **Number of High-** \\ **Risk Techniques** \\ \end{tabular} &
\begin{tabular}{c} **Classified as** \\ **Malicious** \\ \end{tabular} \\ \hline Reconnaissance & Reconnaissance & 0/10 & ✗ \\ Resource Development & Weaponization & 0/7 & ✗ \\ Initial Access & Delivery & 0/9 & ✗ \\ Execution & Exploitation & 5/10 & ✗ \\ Persistence & Installation & 3/9 & ✗ \\ Privilege Escalation & Actions on Objectives & 4/10 & ✗ \\ Defense Evasion & Installation & 10/27 & ✗ \\ Credential Access & Actions on Objectives & 3/7 & ✗ \\ Discovery & Reconnaissance & 0/13 & ✗ \\ Lateral Movement & Actions on Objectives & 5/9 & ✗ \\ Collection & Actions on Objectives & 0/5 & ✗ \\ Command and Control & Command and Control & 8/13 & ✗ \\ Exfiltration & Actions on Objectives & 0/8 & ✗ \\ Impact & Actions on Objectives & 1/1 & ✗ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Classification method using MITRE ATT&CK matrix and Cyber Kill Chain. (ElasticSearch) provides a data search and analytics engine and sends them to the third (Kibana) that facilitates the visualization of the data. Finally, all system information is consumed by Grafiki, which allows the creation of event graphs generated during the execution of malicious techniques in the system. We have named this detection system EDBS (Event Based Detection System). The block diagram of the system is shown on Figure 2.  
The paper published by [PERSON] and [PERSON] [61] similarly applied some of the proposed tools, but with very limited analysis of the results obtained. Only an unspecified piece of software is analyzed against VirusTotal using its hash code. The problem previously discussed can be observed in a similar way in other works which implement similar technologies, as the thesis published by [PERSON] [62] which uses VirusTotal as one of the central components in the classification of malware. In the research published by [PERSON] and [PERSON] [63], the authors describe a methodology for event-driven attack analysis based on signatures whereby their classification method only allows them to detect previously known attacks. Other publications, such as the thesis of [PERSON] [64], rely on the analysis of events generated from the system of the type \"Lateral Movement\" but does not describe the traceability of the generated events and they are not assigned a risk level. In addition, there are other publications that implement possible architectures for threat detection and analysis [65; 66; 67]. These architectures are focused on the detection of suspicious activities in the network, and do not conceive the use of techniques that involve the execution of code directly in the memory of the victim system. Finally, there are papers that support the contextualized event-based analysis model, such as the one published by [PERSON] and [PERSON] [68] that describes both a methodology and a framework that can be implemented to perform the detection of different advanced attacks.