Selecting Log Data Sources to Correlate Attack Traces for Computer Network Security: Preliminary Results

摘要

The success of intrusion detection systems is dependent upon the data they process. In this paper, we consider different audit logs as data sources in order to make decisions about which subset of logs to use for intrusion detection. We evaluate different logs as intrusion detection data sources given different attacks and propose two distinct categories of logs (system and network) that can provide complete and complementary coverage of attacks from start to finish. We end by reporting preliminary results from experiments based on log correlation and visualization of logs.