# Evaluation of Local Security Event Management System vs. Standard Antivirus Software
## 3 Methodology and Implementation
### Related Work  
This paper proposes a detection and threat classification system based on events generated by the operating system in real time, classifying them in the MITRE ATT&CK matrix of techniques and tactics together with their corresponding mapping in the Cyber Kill Chain. The criteria applied is based on the analysis of the events generated by different  
Figure 1: Cyber Kill Chain and MITRE ATT&CK. attacks, checking the tactic and technique where each of them is located within the MITRE ATT&CK matrix and therefore the phase within the Cyber Kill-Chain. Although there are existing works that have carried out research on event-based threat detection and classification systems [55; 56], the one proposed is very effective regardless of the obfuscation method employed. It is important to remark that this system does not pretend to replace the current antivirus systems, since they do their job effectively in most of the known cases of malware. However, it can be considered an extension to improve antivirus in the case of certain malicious code that is obfuscated and executed in memory. In most antivirus software, the analysis of code is only triggered by read or write actions on the hard drive. The number of events collected during the execution of suspicious programs can be very large. Therefore, the current proposal is to match those events to the widely recognized MITRE ATT&CK matrix, and then classify as malicious any vector of attack containing techniques and actions considered of high-risk (from Execution/Exploitation). In future work, it will be possible to provide intelligence to the platform to automatically detect and classify malicious codes more accurately, for example considering the progression of events. Table 1 shows the list of the 14 MITRE tactics, their correlation with the Cyber Kill Chain, the total number of techniques within each Tactic, and how many of those techniques are considered high-risk. It can be observed that for some Tactics, neither technique is considered of high-risk. For example, the Tactic Discovery has 13 different techniques, but none of them is considered malicious. On the other hand, in the case of Command and Control there 8 techniques out of 13 in this category, that are considered high-risk. Consequently, events associated with Discovery tactic will not be classified as malicious, while those associated with Command and Control will very likely classified as malicious (only 5 techniques will not). The reason for having white-listed techniques is because some techniques, such as command execution, can be used in a legitimate way. For example, system commands can be executed by any user and do not represent any threat. The event-based detection system was implemented by combining of a set of open-source tools to automate the analysis of malicious techniques explained above. As a central core we used Sysmon [57; 58], which runs as a resident service on the system and provides logging activity through the Windows event log. The communication between systems for sending information uses Winlogbeat [59] which is an open-source tool for sending Windows event logs to Kafka, which is an open-source distributed event streaming platform. For centralized information reception and analysis, a system based on ELK (ElasticSearch, Logstah and Kibana) was also implemented [60]. The first module (Logstah) is a server-side data processing pipeline that ingests multiple sources simultaneously, the second module