Analysis and implement of PIX firewall syslog log

Gu, Zhaojun; Li, Yong; Wenjing, Niu; Tianjin, China

doi:10.1109/icime.2010.5477784

2010 2nd IEEE International Conference on Information Management and Engineering 2010

DOI: 10.1109/icime.2010.5477784

|View full text |Cite

Analysis and implement of PIX firewall syslog log

Zhaojun Gu

Yong Li

Niu Wenjing

et al.

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2012

Publication Types

Select...

Other1

Relationship

Self Cite0

Independent1

Authors

Journals

Cited by 1 publication

(1 citation statement)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Early work on the study of logs focused on statistical modeling of errors and failure prediction based on the models. Gu Zhaojun [3] implemented a log analysis system which gathered and pretreated syslog logs generated by PIX firewall, then carried on the TopN statistical analysis and detected security events for realizing the effective surveillance on the network behavior. Karel Slavicek [4] described mathematical methods that are trying to be used for syslog message processing.…”

mentioning

confidence: 99%

The design and implement of the centralized log gathering and analysis system

Huang

Zhang

Jiang

2012

2012 IEEE International Conference on Computer Science and Automation Engineering (CSAE)

View full text Add to dashboard Cite

Logs generated by network devices and systems provide important information for network management. In this paper, we describe a centralized syslog system which gathers and analyzes log messages from a number of routers, switches and firewalls. The gathered logs are filtered and categorized with regular expression, and finally stored in a MySQL database with format. Through the statistics analysis, feature-based detection on security events, the system can effectively find out abnormal behavior of network devices and ensure the network security. Some methods are found out to allow us to check if the network behavior is unusual. These perspective methods also provide the basis of network management and security strategy design for administrators, thereby strengthen further network management. I. INTRODUCTIONWith the continuous and rapid development of the computer networks and network applications, the security issues need more special attention. In order to safeguard the network security, people tend to adopt quite a lot measures.Among them, the log messages which record various system events occurred every day in the network devices, play an important role in network security management. Shanghai education and research network (SHERNET)is a large metropolitan computer network, which connects all the universities in Shanghai. The backbone nodes which composed a ring topology are connected by 10 NE40E routers. Each node site consists of a large number of routers, switches, firewalls, and application servers. Since the SHERNET has been transformed several times, the number, species and complexity of the network devices are increasing sharply. In order to find out the network anomalies and security threats, it is necessary to view all the log messages generated every day by active networking devices. It is out of human capabilities. So we should use some special software tools which help us to skip over mostly daily event messages to find out the network anomalies and security threats effectively and accurately.As the complexity and diversity of the network devices, a standard network protocol named syslog is applied to gather log messages from firewalls, routers, switches and other network devices. For the purpose of solving problems in practice, a syslog system which can gather, analyze and store log messages is designed. Network devices in SHERNET can send their log messages to the centralized syslog server which filters raw logs and stores parsed results.By collecting and extracting useful information, the administrators can keep abreast of the network status and solve security issues timely.The rest of the paper is organized as follows. Section II discusses related works on syslog. Section III presents an overview of our system. Section IV gives implementation of the system. Section V gives statistical analysis techniques to logs. Section VI concludes with a discussion of the results. II. RELATED WORKS A. Syslog ProtocolThe syslog protocol was introduced by the Computer Science Research Group (CSRG) at the Univ...

show abstract

mentioning

confidence: 99%

The design and implement of the centralized log gathering and analysis system

Huang

Zhang

Jiang

2012

2012 IEEE International Conference on Computer Science and Automation Engineering (CSAE)

View full text Add to dashboard Cite

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

hi@scite.ai

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

Analysis and implement of PIX firewall syslog log

Cited by 1 publication

References 0 publications

The design and implement of the centralized log gathering and analysis system

The design and implement of the centralized log gathering and analysis system

Contact Info

Product

Resources

About