Implementation of the distributed hierarchical security operation center using mobile agent group

This paper proposes a novel hierarchical mobile-agent-based Security Operation Center (HMSOC) to overcome traditional SOC vulnerability in a fixed location suffering single point of failure attack. Furthermore, each division has its own alert and aggregation methodology. By IDMEF, session and timer methods, data from various divisions are fused and correlated efficiently in our proposed HMSOC. A prototype implemented in a network testbed shows HMSOC efficacy. The proposed HMSOC effectively integrates various alerts in a large network environment.