Innovative software tool for cyber security against security incidents in civil aviation network operations

The Security Incident and Operation Centre is designed to aggregate events from heterogeneous systems, analyze them, and alert any deviations from expected behavior. It was developed for the "Innovative software tool for cyber security against security incidents in civil aviation network operations" project to gather and analyze security events from object and network security and monitoring systems. Aim of this paper is to introduce the system, explain how it works, its shortcomings and real-life experience upon which the system was periodically improved. After analyzing the use and the results we discuss the shortcomings and the ability of the system to fight these mistakes as well as giving tools to the users to fix them on the go, which adds to the system usability and versatility. In the end we conclude that the system does achieve its set goals.