Exploring syntactical features for anomaly detection in application logs-Reference-Cited by-同舟云学术

Exploring syntactical features for anomaly detection in application logs

Published:2022-03-23 Issue:1-2 Volume:64 Page:15-27
ISSN:2196-7032
Container-title:it - Information Technology
language:en
Short-container-title:

Author:

Copstein Rafael¹,Karlsen Egil¹,Schwartzentruber Jeff²,Zincir-Heywood Nur¹,Heywood Malcolm¹

Affiliation:

1. 153020 Dalhousie University , Faculty of Computer Science , 6299 South Street , Halifax , NS , Canada

2. 2Keys , 20 Eglinton Ave. W. – Suite 1500 , Toronto , Ontario , Canada

Abstract

Abstract In this research, we analyze the effect of lightweight syntactical feature extraction techniques from the field of information retrieval for log abstraction in information security. To this end, we evaluate three feature extraction techniques and three clustering algorithms on four different security datasets for anomaly detection. Results demonstrate that these techniques have a role to play for log abstraction in the form of extracting syntactic features which improves the identification of anomalous minority classes, specifically in homogeneous security datasets.

Publisher

Walter de Gruyter GmbH

Subject

General Computer Science

Link

https://www.degruyter.com/document/doi/10.1515/itit-2021-0064/pdf

Reference25 articles.

1. J. Zhu, S. He, J. Liu, P. He, Q. Xie, Z. Zheng, and M. R. Lyu, “Tools and benchmarks for automated log parsing,” in 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP), 2019, pp. 121–130.

2. D. El-Masri, F. Petrillo, Y.-G. Guéhéneuc, A. Hamou-Lhadj, and A. Bouziane, “A systematic literature review on automated log abstraction techniques,” Information and Software Technology, vol. 122, p. 106276, 2020.

3. R. Copstein, J. Schwartzentruber, N. Zincir-Heywood, and M. Heywood, “Log abstraction for information security: Heuristics and reproducibility,” in The 16th International Conference on Availability, Reliability and Security, ser. ARES 2021. New York, NY, USA: Association for Computing Machinery, 2021. [Online]. Available: https://doi.org/10.1145/3465481.3470083.

4. B. Gallagher and T. Eliassi-Rad, “Classification of http attacks: a study on the ecml/pkdd 2007 discovery challenge,” Lawrence Livermore National Lab.(LLNL), Livermore, CA (United States), Tech. Rep., 2009.

5. H. Dev and Z. Liu, “Identifying frequent user tasks from application logs,” in Proceedings of the 22nd International Conference on Intelligent User Interfaces, ser. IUI ’17. New York, NY, USA: Association for Computing Machinery, 2017, pp. 263–273. [Online]. Available: https://doi.org/10.1145/3025171.3025184.

Cited by 4 articles. 订阅此论文施引文献订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献

1. Benchmarking Large Language Models for Log Analysis, Security, and Interpretation;Journal of Network and Systems Management;2024-06-13

2. Large language models and unsupervised feature learning: implications for log analysis;Annals of Telecommunications;2024-04-04

3. Assessing the impact of bag‐of‐words versus word‐to‐vector embedding methods and dimension reduction on anomaly detection from log files;International Journal of Network Management;2023-10-27

4. Exploring Semantic vs. Syntactic Features for Unsupervised Learning on Application Log Files;2023 7th Cyber Security in Networking Conference (CSNet);2023-10-16