Conference paper
Automatic log parser to support forensic analysis
16th Australian Digital Forensics Conference (Edith Cowan, Joondalup, 04/12/2018–05/12/2018)
2018
Abstract
Event log parsing is a process to split and label each field in a log entry. Existing approaches commonly use regular expressions or parsing rules to extract the fields. However, such techniques are time-consuming as a forensic investigator needs to define a new rule for each log file type. In this paper, we present a tool, namely nerlogparser, to parse the log entries automatically, where log parsing is modeled as a named entity recognition problem. We use a deep machine learning technique, specifically the bidirectional long short-term memory networks, as the underlying architecture for this purpose. Unlike existing tools, nerlogparser is a fully automatic tool as the investigators do not need to define any parsing rules and it is generic as there is only one model to parse various types of log files. Experimental results show that nerlogparser achieves superior performance compared with other traditional machine learning methods.
Details
- Title
- Automatic log parser to support forensic analysis
- Authors/Creators
- H. Studiawan (Author/Creator)F. Sohel (Author/Creator)C. Payne (Author/Creator)
- Conference
- 16th Australian Digital Forensics Conference (Edith Cowan, Joondalup, 04/12/2018–05/12/2018)
- Identifiers
- 991005543139307891
- Murdoch Affiliation
- School of Engineering and Information Technology
- Language
- English
- Resource Type
- Conference paper
Metrics
932 File views/ downloads
453 Record Views