Present and Future of Network Security Monitoring Fuentes García, Noemí Marta Camacho Páez, José Macía Fernández, Gabriel Network security NSM Security monitoring Incident detection Incident response SDN IoT This work was funded by the Ministry of Science and Innovation through CDTI through the Ayudas Cervera para Centros Tecnologicos grant of the Spanish Centre for the Development of Industrial Technology (CDTI) through the Project EGIDA under Grant CER-20191012, and in part by the Spanish Ministry of Economy and Competitiveness and European Regional Development Fund (ERDF) funds under Project TIN2017-83494-R. Network Security Monitoring (NSM) is a popular term to refer to the detection of security incidents by monitoring the network events. An NSM system is central for the security of current networks, given the escalation in sophistication of cyberwarfare. In this paper, we review the state-of-the-art in NSM, and derive a new taxonomy of the functionalities and modules in an NSM system. This taxonomy is useful to assess current NSM deployments and tools for both researchers and practitioners. We organize a list of popular tools according to this new taxonomy, and identify challenges in the application of NSM in modern network deployments, like Software Defined Network (SDN) and Internet of Things (IoT). 2021-10-13T10:29:23Z 2021-10-13T10:29:23Z 2021-03-18 journal article M. Fuentes-García, J. Camacho and G. Maciá-Fernández, "Present and Future of Network Security Monitoring," in IEEE Access, vol. 9, pp. 112744-112760, 2021, doi: [10.1109/ACCESS.2021.3067106] http://hdl.handle.net/10481/70823 10.1109/ACCESS.2021.3067106 eng http://creativecommons.org/licenses/by-nc-nd/3.0/es/ open access Atribución-NoComercial-SinDerivadas 3.0 España IEEE