Igli Tafa and Kevin Shahollari, Polytechnic University of Tirana, Tirana

The rapid evolution of technology has increased the role of cybersecurity and put it at the center of nationalcritical infrastructure. This role supports and guarantees the vital services of (CNI) while provides the proper functionalities for running operations between the public and private sectors. This evolution has hadthe same impact on cyberattack tools, methods, techniques used to gain unauthorized access to these computer systems that contain confidential and high-value information in the digital data sales market or asit called "darkweb". As a result, it has become necessary to monitor all events of the National Critical Infrastructure (CNI) computer systems. This proposed system uses a centralized National SIEM (N-SIEM) specializing in the correlation of security events caused by cyber attacks, collected by CNIs systems while integrating with anInternational Cyber Threat Intelligence system (ICTI-CNI). In addition, this conceptual model collects security breach events of CNIs systems, analyzes only cyber attacks, and correlates these security events in real-time with an intelligent automated platform while reducing the response time of security analysts.

CNI, N-SIEM, ICTI-CNI, IOC, cyber attacks security events.