Method of chronological reconstruction of events in information communication systems for cyber security purposes based on the coordination of local time spaces
Year: 2025
Type: article
Abstract: The article considers the topical scientific task of chronological reconstruction of events in information and communication systems (ICS) in conditions of asynchronism of their subsystems (components) and time stamp errors. In practice, the order of events recorded in monitoring logs often does not correspond to the actual sequence due to the drift of system clocks, delays in data transmission or processing, as well as the asynchrony of the time scales of different event sources. Modern cyber protection systems focused on event correlation often rely on such distorted chronology, which leads to false conclusions during the analysis of cyber incidents and significantly complicates the establishment of causeand-effect relationships between events. A method of chronological reconstruction of events is proposed, which is based on rejecting the assumption of a single global system time, does not require synchronisation of monitoring sources, and restores the global order based on reference links between events from different event logs. It provides for the formation of a set of local time spaces from event logs, the determination of reference and stabilising links between them, the search for optimal time shifts using the grid search method, and the integration of results into a single chronology of ICS events. An experimental study conducted using data generated based on MITRE ATT&CK cyberattack techniques confirms the effectiveness of the proposed approach, achieving 96 % reconstruction accuracy. The results show that the method provides high reliability in reproducing event sequences in the absence of clock synchronisation between subsystems. The proposed method can be used in cyber incident monitoring and analysis systems in ICS to improve the accuracy of event correlation and the reliability of reconstructing cause-and-effect chains between them.
Authors: I. Subach, V. Fesioha, R. Kravchyk
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W4417112643
FWCI:
Cites:
Cited by:
Related to: