Semantic Interpretation of Structured Log Files

Simple item page
dc.contributor.authorNimbalkar, Piyush
dc.contributor.authorMulwad, Varish
dc.contributor.authorPuranik, Nikhil
dc.contributor.authorJoshi, Anupam
dc.contributor.authorFinin, Tim
dc.date.accessioned2018-10-30T16:52:29Z
dc.date.available2018-10-30T16:52:29Z
dc.date.issued2016-12-19
dc.description17th IEEE International Conference on Information Reuse and Integrationen_US
dc.description.abstractData from computer log files record traces of events involving user activity, applications, system software and network traffic. Logs are usually intended for diagnostic and debugging purposes, but their data can be extremely useful in system audits and forensic investigations. Logs created by intrusion detection systems, web servers, anti-virus and anti-malware systems, firewalls and network devices have information that can reconstruct the activities of malware or a malicious agent, help plan for remediation and prevent attacks by revealing probes or intrusions before damage has been done. While existing tools like Splunk can help analyze logs with known schemas, understanding log whose format is unfamiliar or associated with new device or custom application can be challenging. We describe a framework for analyzing logs and automatically generating a semantic description of their schema and content in RDF. The framework begins by normalizing the log into columns and rows using regular expression-based and dictionary-based classifiers. Leveraging our existing work on inferring the semantics of tables, we associate semantic types with columns and, when possible, map them to concepts in general knowledge-bases (e.g. DBpedia) and domain specific ones (e.g., Unified Cybersecurity Ontology). We link cell values to known type instances (e.g., an IP address) and suggest relationships between columns. Converting large and verbose log files into such semantic representations reveals their meaning and supports search, integration and reasoning over the data.en_US
dc.description.sponsorshipSupport for this work was provided by NSF grants 1250627, 1228198 and a gift from Microsoft. One of the authors also acknowledges support from the Oros Family Professorship endowment.en_US
dc.description.urihttps://ieeexplore.ieee.org/document/7785790en_US
dc.format.extent7 pagesen_US
dc.genreconference papers and proceedings pre-printen_US
dc.identifierdoi:10.13016/M2DZ0355X
dc.identifier.citationPiyush Nimbalkar, Varish Mulwad, Nikhil Puranik, Anupam Joshi, and Tim Finin, Semantic Interpretation of Structured Log Files, 2016 IEEE 17th International Conference on Information Reuse and Integration (IRI) , 10.1109/IRI.2016.81en_US
dc.identifier.uri10.1109/IRI.2016.81
dc.identifier.urihttp://hdl.handle.net/11603/11791
dc.language.isoen_USen_US
dc.publisherIEEEen_US
dc.relation.isAvailableAtThe University of Maryland, Baltimore County (UMBC)
dc.relation.ispartofUMBC Computer Science and Electrical Engineering Department Collection
dc.relation.ispartofUMBC Faculty Collection
dc.rightsThis item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
dc.rights© 2016 IEEE
dc.subjectlog filesen_US
dc.subjectCybersecurityen_US
dc.subjectlinked dataen_US
dc.subjectfirewallsen_US
dc.subjectinvasive softwareen_US
dc.subjectpattern classificationen_US
dc.subjectsemantic interpretationen_US
dc.subjectUMBC Ebiquity Research Groupen_US
dc.subjectregular expression-based classifiersen_US
dc.subjectnetwork devicesen_US
dc.subjectanti-malware systemsen_US
dc.subjectResource description frameworken_US
dc.subjectOntologiesen_US
dc.titleSemantic Interpretation of Structured Log Filesen_US
dc.typeTexten_US

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
812.pd.pdf
Size:
263.09 KB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
1.68 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

UMBC Computer Science and Electrical Engineering Department
UMBC Faculty Collection