Improving Security Through Analysis of Log Files Intersections

The paper discusses our research in development of general and systematic methods for intrusion prevention. The key idea is to use data mining techniques to discover repeated patterns of system features that describe program and user behavior. Server systems customarily write comprehensive activity logs whose value is useful in detecting intrusion. Unfortunately, production volumes overwhelm the capacity and manageability of traditional approach. This paper discusses the issues involving largescale log processing that helps to analyze log records. Here, we propose to analyze intersections of firewall log files with application log files installed on one computer, as well as intersections resulting from firewall log files with application log files coming from different computers. Intersections of log files are substantially shorter than full logs and consist of records that indicate abnormalities in accessing single computer or set of computers. The paper concludes with some lessons w...

• Type: Journal
• Year: 2008
• Where: IJNSEC
• Authors: Kazimierz Kowalski, Mohsen Beheshti
• Keywords: Application Log, Computers, Firewall Log, IJNSEC 2008