Getting value from the data collected and providing analytics on top of it for enhancing fraud detection and incident prevention.
Big data security analytics is simply a collection of security data sets so large and complex that it becomes difficult (or impossible) to process using on-hand database management tools or traditional security data processing applications.
Big Data & Security Analytics tools operate in near real time and generate a small number of security alerts ranked by severity according to a risk model. These alerts are enriched with additional forensic details and are able to greatly simplify a security analyst’s job and enable quick detection and mitigation of cyber attacks.
Big data analytics tools have the ability to accurately discover devices on a network.
Big data security analytics solutions also distinguish themselves based upon these basic characteristics:
- Big data security analytics solutions must have the ability to collect, process, and store terabytes to petabytes of data for an assortment of security analytics activities.
These platforms must have the ability to collect data in real or near real time.
The ability to correlate events across time and space that is a key differentiator of big data analytics platforms.
- Analytical flexibility. Big data security analytics solutions must provide users with the ability to interact, query, and visualize this volume of data in an assortment of ways.
- Performance. Big data security analytics must be built with appropriate compute architecture to process data analytic algorithms and complex queries and then deliver results in an acceptable timeframe. In the early stages of this market, big data security analytics solutions are being developed and introduced along a continuum.
- Reporting and visualization.
Visualization tools are also needed to present information derived from big data sources in ways that can be readily and rapidly identified by security analysts.
- Persistent big data storage.
These platforms employ big data storage systems, such as the Hadoop Distributed File System (HDFS) and longer latency archival storage.
Big data security analytics is qualitatively different from other forms of security analytics. The need for scalability, tools for integrating and visualizing diverse types of data, the increasingly importance of contextual information, and the breadth of security functions that must be supported in big data security analytics are leading vendors to apply advanced data analysis and storage tools to information security.
