An Approach of Anomaly Diagnosis with Logs for Distributed Services in Communication Network Information System

Sun, Kang; Li, Meng; Guo, Shaoyong; Xu, Siya; Wang, Ying; Li, Weijian

doi:10.1109/ispa/iucc.2017.00144

Cited by 4 publications

(1 citation statement)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the field of log analysis, there is a lot of research on anomaly-based detection. Sun et al [13] proposed an anomaly detection method based on a time-weighted control fault graph model to reduce manual detection. Pecchia et al [14] performed process mining to extract normal models for fault detection from application logs and performed anomaly detection based on the models.…”

Section: Log Analysismentioning

confidence: 99%

Efficient Matching Algorithms between Logs and Indicators for Automatic Incident Response System

Okada

Hashimoto

Mitsunaga

2023

Journal of Information Processing

View full text Add to dashboard Cite

Cyber Threat Information (so-called indicator) sharing plays an important role in rapid incident response, and ISAC and MISP provide information sharing schemes. Companies and organizations receive indicators and check whether their employees' computers and servers are exposed to threats by referring to their proxy and access logs. We have already proposed an incident response scheme that automates this sequence of procedures. Meanwhile, the amount of logs generated per day in large companies and organizations is enormous. In addition, the number of indicators received is expected to increase. In that situation, a naive matching algorithm between indicators and logs can take a considerable amount of time and delay incident response seriously, even when using our proposed system. Therefore, we propose a more effective matching algorithm. We also implemented the algorithms and measured their elapsed time and memory consumption. In addition, we compare our algorithms with basic and naive matching algorithms from both a theoretical and practical perspective. As a result, our proposed algorithm ran faster with a little additional memory consumption. Combining this algorithm and our previously proposed incident response system, we achieve a more effective one than before.

show abstract

Section: Log Analysismentioning

confidence: 99%