SIEM-Based Cybersecurity Monitoring System

SIEM-Based Cybersecurity Monitoring System
CHAPTER ONE: INTRODUCTION
1.1 Background of the Study
In the modern digital landscape, organizations face an increasingly sophisticated and relentless threat landscape. Cyberattacks ranging from advanced persistent threats (APTs) and ransomware campaigns to insider threats and distributed denial-of-service (DDoS) attacks target enterprise networks, endpoints, and cloud infrastructure daily. As IT environments expand to encompass hybrid cloud platforms, microservices, and remote workforces, the volume of generated security telemetry and log data grows exponentially. In this environment, monitoring isolated security event logs manually is entirely ineffective.
To achieve holistic visibility and real-time threat detection, modern enterprises deploy a Security Information and Event Management (SIEM) system. A SIEM-based cybersecurity monitoring system aggregates log data from diverse sources across the enterprise—including firewalls, operating systems, web servers, intrusion detection systems, and application audit trails—into a centralized repository. By performing real-time log normalization, correlation analysis, and automated threat intelligence matching, a SIEM empowers security operations center (SOC) analysts to detect anomalies, investigate security incidents, and mitigate threats before they cause catastrophic data breaches.
1.2 Statement of the Problem
Despite the critical necessity of centralized security monitoring, organizations implementing SIEM solutions frequently encounter severe technical and operational challenges:
• Log Data Overload and Normalization Complexity: Enterprises generate millions of disparate log formats daily. Ingesting, parsing, and normalizing heterogeneous logs into a unified schema requires intensive compute power and robust data pipelines.
• Alert Fatigue and High False-Positive Rates: Poorly tuned correlation rules often flood security teams with thousands of low-priority or false-positive alerts daily, obscuring genuine critical threat indicators.
• Delayed Incident Detection and Response: Without automated event correlation and real-time alerting, malicious lateral movement and data exfiltration can go undetected for weeks or months.
• Prohibitive Licensing Costs of Commercial SIEM Suites: Enterprise-grade commercial SIEM platforms feature restrictive, data-volume-based licensing fees that strain the budgets of growing organizations.
1.3 Aim and Objectives
• Aim: The aim of this project is to design, implement, and evaluate a centralized SIEM-Based Cybersecurity Monitoring System capable of ingesting security logs, executing real-time threat correlation rules, generating security alerts, and visualizing threat metrics through an administrative dashboard.
• Objectives: The specific objectives are to:
1. Conduct a comprehensive requirement analysis for log ingestion pipelines, normalization schemas, threat correlation rules, and incident dashboard workflows.
2. Design a robust three-tier system architecture and a normalized relational database schema to store ingested security logs, correlation rules, active security incidents, and audit trails.
3. Implement backend ingestion and correlation modules capable of parsing syslog/JSON event streams, evaluating heuristic security rules, and triggering high-severity alerts.
4. Develop a responsive security monitoring web dashboard enabling SOC analysts to view real-time threat maps, investigate log anomalies, and manage incident lifecycles.
5. Test and evaluate the deployed SIEM system for log ingestion throughput, correlation rule detection accuracy, alert latency, and system performance under simulated multi-source log traffic.
1.4 Significance of the Study
This project provides substantial value to enterprise cybersecurity operations and security engineering practice. For organizations, it offers a scalable, transparent, and cost-effective blueprint for implementing centralized log monitoring and real-time threat detection. For software engineers and security analysts, it demonstrates practical implementation patterns for building log parsing pipelines, event correlation engines, and security operations center (SOC) visualization dashboards.
1.5 Scope and Limitations
• Scope: The project covers user authentication, multi-source log ingestion (Syslog/REST API endpoints), log normalization and parsing, rule-based event correlation (detecting brute-force attacks, unauthorized root access, and suspicious IP connections), incident alerting, and an interactive security operations dashboard.
• Limitations: The system focuses primarily on application, server, and firewall log correlation. It does not natively incorporate advanced machine learning anomaly detection models or automated endpoint response (EDR) remediation scripts.
CHAPTER TWO: LITERATURE REVIEW
2.1 Conceptual Framework
A SIEM-Based Cybersecurity Monitoring System operates on foundational security information management and event management principles:
• Log Aggregation & Ingestion: The centralized collection of event records, audit trails, and telemetry from distributed network nodes and applications.
• Log Normalization & Parsing: The transformation of unstructured or semi-structured log entries from diverse vendors into a standardized, searchable schema (e.g., standardizing timestamps, IP fields, and action types).
• Event Correlation: The automated analysis of multiple disparate log events over a sliding time window to identify complex, multi-stage attack patterns that single log entries would fail to reveal (e.g., multiple failed logins followed immediately by a successful root login from an external IP).
• Security Incident Management: The lifecycle tracking of detected security events from initial automated detection through analyst triage, investigation, and closure.