Data Scheme Conversion Proposal for Information Security Monitoring Systems

Information security monitoring in a highly distributed environment requires gathering and processing data describing state of its components. To allow successful interpretation of that data, they cannot be acquired in any form - numerous meta languages and description schemes are available, but usually only one or few of them is supported by a given data source. A set of those schemes supported by a given device or program is defined by its manufacturer, and because of utilization of proprietary formats, usually it is impossible to apply a single scheme to all data sources. As a consequence, it is necessary to apply data conversion scheme, transforming various incompatible messages to a chosen data scheme, supported by the main repository and the analytic subsystem. Only then it is possible to process data to determine the current state of security of the whole information system.