CPL - Chalmers Publication Library
| Utbildning | Forskning | Styrkeområden | Om Chalmers | In English In English Ej inloggad.

Extracting attack manifestations to determine log data requirements for intrusion detection

Emilie Lundin Barse (Institutionen för datorteknik, Datasäkerhet) ; Erland Jonsson (Institutionen för datorteknik, Datasäkerhet)
20th Annual Computer Security Applications Conference (ACSAC 2004) (2004)
[Konferensbidrag, refereegranskat]

Log data adapted for intrusion detection is a little explored research issue despite its importance for successful and efficient detection of attacks and intrusions. This paper presents a starting point in the search for suitable log data by providing a framework for determining exactly which log data that can reveal a specific attack, i.e. the attack manifestations. An attack manifestation consists of the log entries added, changed or removed by the attack compared to normal behaviour. We demonstrate the use of the framework by studying attacks in different types of log data. This work provides a foundation for a fully automated attack analysis. It also provides some pointers for how to define a collection of log elements that are both sufficient and necessary for detection of a specific group of attacks. We believe that this will lead to a log data source that is especially adapted for intrusion detection purposes.

Nyckelord: intrusion detection, attack manifestations, log data, data collection

Denna post skapades 2006-09-12.
CPL Pubid: 2357


Institutioner (Chalmers)

Institutionen för datorteknik, Datasäkerhet (2002-2004)


Information Technology

Chalmers infrastruktur