Big data security analytics is simply a collection of security data sets so large and complex that it becomes difficult (or impossible) to process using on-hand database management tools or traditional security data processing applications.
Big Data & Security Analytics tools operate in near real time and generate a small number of security alerts ranked by severity according to a risk model. These alerts are enriched with additional forensic details and are able to greatly simplify a security analyst’s job and enable quick detection and mitigation of cyber attacks.
Big data analytics tools have the ability to accurately discover devices on a network.
Big data security analytics solutions also distinguish themselves based upon these basic characteristics:
These platforms must have the ability to collect data in real or near real time.
The ability to correlate events across time and space that is a key differentiator of big data analytics platforms.
Visualization tools are also needed to present information derived from big data sources in ways that can be readily and rapidly identified by security analysts.
These platforms employ big data storage systems, such as the Hadoop Distributed File System (HDFS) and longer latency archival storage.
Big data security analytics is qualitatively different from other forms of security analytics. The need for scalability, tools for integrating and visualizing diverse types of data, the increasingly importance of contextual information, and the breadth of security functions that must be supported in big data security analytics are leading vendors to apply advanced data analysis and storage tools to information security.