Conference paper
Automatic event log abstraction to support forensic investigation
Proceedings of the Australasian Computer Science Week Multiconference
ACSW '20: Australasian Computer Science Week 2020 (Swinburne University of Technology, Melbourne, 03/02/2020–07/02/2020)
2020
Abstract
Abstraction of event logs is the creation of a template that contains the most common words representing all members in a group of event log entries. Abstraction helps the forensic investigators to obtain an overall view of the main events in a log file. Existing log abstraction methods require user input parameters. This manual input is time consuming due to the need to identify the best parameters, especially when a log file is large. We propose an automatic method to facilitate event log abstraction avoiding the need for the user to manually identify suitable parameters. We model event logs as a graph and propose a new graph clustering approach to group log entries. The abstraction is then extracted from each cluster. Experimental results show that the proposed method achieves superior performance compared to existing approaches with an F-measure of 95.35%.
Details
- Title
- Automatic event log abstraction to support forensic investigation
- Authors/Creators
- H. Studiawan (Author/Creator) - Murdoch UniversityF. Sohel (Author/Creator) - Murdoch UniversityC. Payne (Author/Creator) - Murdoch University
- Publication Details
- Proceedings of the Australasian Computer Science Week Multiconference
- Conference
- ACSW '20: Australasian Computer Science Week 2020 (Swinburne University of Technology, Melbourne, 03/02/2020–07/02/2020)
- Identifiers
- 991005541151607891
- Murdoch Affiliation
- Information Technology, Mathematics and Statistics
- Language
- English
- Resource Type
- Conference paper
Metrics
174 File views/ downloads
131 Record Views