Filtering events using clustering in heterogeneous security logs
Log files are rich sources of information exhibiting the actions performed during the usage of a computer system in our daily work. In this study we concentrate on parsing/isolating logs from different sources and then clustering the logs using data mining tool (Weka) to filter the unwanted entries...
Saved in:
Main Authors: | , , , |
---|---|
Format: | Article |
Language: | English |
Published: |
Asian Network for Scientific Information
2011
|
Online Access: | http://psasir.upm.edu.my/id/eprint/22453/1/Filtering%20events%20using%20clustering%20in%20heterogeneous%20security%20logs.pdf http://psasir.upm.edu.my/id/eprint/22453/ http://scialert.net/abstract/?doi=itj.2011.798.806 |
Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
Institution: | Universiti Putra Malaysia |
Language: | English |
id |
my.upm.eprints.22453 |
---|---|
record_format |
eprints |
spelling |
my.upm.eprints.224532016-06-08T08:33:10Z http://psasir.upm.edu.my/id/eprint/22453/ Filtering events using clustering in heterogeneous security logs Hajamydeen, Asif Iqbal Udzir, Nur Izura Mahmod, Ramlan Abd Ghani, Abdul Azim Log files are rich sources of information exhibiting the actions performed during the usage of a computer system in our daily work. In this study we concentrate on parsing/isolating logs from different sources and then clustering the logs using data mining tool (Weka) to filter the unwanted entries in the logs which will greatly help in correlating the events from different logs. Unfortunately parsing heterogeneous logs to extract the attribute values becomes tedious, since every type of log is stored in a proprietary format. We propose a framework that has the ability to parse and isolate a variety of logs, followed by clustering the logs to identify and remove unneeded entries. Experiments involving a range of logs, reveals the fact that clustering has the capacity to group log entries with a higher degree of accuracy, thereby assisting to identify correctly the entries to be removed. Asian Network for Scientific Information 2011 Article PeerReviewed application/pdf en http://psasir.upm.edu.my/id/eprint/22453/1/Filtering%20events%20using%20clustering%20in%20heterogeneous%20security%20logs.pdf Hajamydeen, Asif Iqbal and Udzir, Nur Izura and Mahmod, Ramlan and Abd Ghani, Abdul Azim (2011) Filtering events using clustering in heterogeneous security logs. Information Technology Journal, 10 (4). pp. 798-806. ISSN 1812-5638; ESSN: 1812-5646 http://scialert.net/abstract/?doi=itj.2011.798.806 10.3923/itj.2011.798.806 |
institution |
Universiti Putra Malaysia |
building |
UPM Library |
collection |
Institutional Repository |
continent |
Asia |
country |
Malaysia |
content_provider |
Universiti Putra Malaysia |
content_source |
UPM Institutional Repository |
url_provider |
http://psasir.upm.edu.my/ |
language |
English |
description |
Log files are rich sources of information exhibiting the actions performed during the usage of a computer system in our daily work. In this study we concentrate on parsing/isolating logs from different sources and then clustering the logs using data mining tool (Weka) to filter the unwanted entries in the logs which will greatly help in correlating the events from different logs. Unfortunately parsing heterogeneous logs to extract the attribute values becomes tedious, since every type of log is stored in a proprietary format. We propose a framework that has the ability to parse and isolate a variety of logs, followed by clustering the logs to identify and remove unneeded entries. Experiments involving a range of logs, reveals the fact that clustering has the capacity to group log entries with a higher degree of accuracy, thereby assisting to identify correctly the entries to be removed. |
format |
Article |
author |
Hajamydeen, Asif Iqbal Udzir, Nur Izura Mahmod, Ramlan Abd Ghani, Abdul Azim |
spellingShingle |
Hajamydeen, Asif Iqbal Udzir, Nur Izura Mahmod, Ramlan Abd Ghani, Abdul Azim Filtering events using clustering in heterogeneous security logs |
author_facet |
Hajamydeen, Asif Iqbal Udzir, Nur Izura Mahmod, Ramlan Abd Ghani, Abdul Azim |
author_sort |
Hajamydeen, Asif Iqbal |
title |
Filtering events using clustering in heterogeneous security logs |
title_short |
Filtering events using clustering in heterogeneous security logs |
title_full |
Filtering events using clustering in heterogeneous security logs |
title_fullStr |
Filtering events using clustering in heterogeneous security logs |
title_full_unstemmed |
Filtering events using clustering in heterogeneous security logs |
title_sort |
filtering events using clustering in heterogeneous security logs |
publisher |
Asian Network for Scientific Information |
publishDate |
2011 |
url |
http://psasir.upm.edu.my/id/eprint/22453/1/Filtering%20events%20using%20clustering%20in%20heterogeneous%20security%20logs.pdf http://psasir.upm.edu.my/id/eprint/22453/ http://scialert.net/abstract/?doi=itj.2011.798.806 |
_version_ |
1643827832473780224 |