Faster log analysis and integration of security incidents using knuth-bendix completion

Authors:
Ruo Ando;Shinsuke Miwa
Affiliations:
National Institute of Information and Communication Technology, Koganei, Tokyo, Japan;National Institute of Information and Communication Technology, Koganei, Tokyo, Japan
Venue:
ICONIP'11 Proceedings of the 18th international conference on Neural Information Processing - Volume Part II
Year:
2011

Citing 6
Cited 0

The problem of explaining the disparate performance of hyperresolution and paramodulation

Journal of Automated Reasoning
The problems of self-analytically choosing the weights

Journal of Automated Reasoning
The problem of choosing the type of subsumption to use

Journal of Automated Reasoning
Educational environment on StarBED: case study of SOI Asia 2008 Spring Global E-Workshop

Proceedings of the 4th Asian Conference on Internet Engineering
Automated Log Analysis of Infected Windows OS Using Mechanized Reasoning

ICONIP '09 Proceedings of the 16th International Conference on Neural Information Processing: Part II
Synoptic: summarizing system logs with refinement

SLAML'10 Proceedings of the 2010 workshop on Managing systems via log analysis and machine learning techniques

Quantified Score

Hi-index	0.00

Visualization

Abstract

With the rapid popularization of cloud computing, mobile devices and high speed Internet, recent security incidents have become more complicated which imposes a great burden on network administrators. In this paper we propose an integration and simplification method of log strings obtained by many kinds of computer devices: memory, socket and file. Besides, we apply reasoning strategy for term rewriting called as Knuth-Bendix completion algorithm for ensuring termination and confluent. Knuth Bendix completion includes some inference rules such as lrpo (the lexicographic recursive path ordering) and dynamic demodulation. As a result, we can achieve the reduction of generated clauses which result in faster integration of log strings. In experiment, we present the effectiveness of proposed method by showing the result of exploitation of vulnerability and malware's behavior log.