Improving Security through Analysis of Log Files Intersections

Kazimierz Kowalski ； Mohsen Beheshti

《International Journal of Network Security》 7卷1期 (2008/07) Pp. 24-30

https://doi.org/10.6633/IJNS.200807.7(1).03

並列摘要

The paper discusses our research in development of general and systematic methods for intrusion prevention. The key idea is to use data mining techniques to discover repeated patterns of system features that describe program and user behavior. Server systems customarily write comprehensive activity logs whose value is useful in detecting intrusion. Unfortunately, production volumes overwhelm the capacity and manageability of traditional approach. This paper discusses the issues involving large-scale log processing that helps to analyze log records. Here, we propose to analyze intersections of firewall log files with application log files installed on one computer, as well as intersections resulting from firewall log files with application log files coming from different computers. Intersections of log files are substantially shorter than full logs and consist of records that indicate abnormalities in accessing single computer or set of computers. The paper concludes with some lessons we learned in building the system.

並列關鍵字

Data mining ； intrusion prevention ； log les ； security architectures