New approaches for intrusion detection based on logs correlation

Abstract

Network administrators are able to correlate log file entries manually. Large volume and low quality of log files justify the need for further log processing. The manual log processing is lack of flexibility. It is time consuming, and one doesn't get the general view of the log files in the network. Without this general view it is hard to correlate information between the network components. Events seemingly unessential by themselves can in reality be a piece of a larger threat. In this regard, different log correlation methods are proposed to improve alert quality and to give a comprehensive view of system security. In this paper, we show how different attacks categorized in three categories with different behavior: Denial of Service (DoS) attacks, User-to-Root (U2R) & Remote-to-Local (R2L) attacks and Probing, are reflected in different logs and argue that some attacks are not evident when a single log is analyzed.