Towards a neural language model for signature extraction from forensic logs

Onderzoeksoutput: Hoofdstuk in Boek/Rapport/CongresprocedureConferentiebijdrageAcademicpeer review

1 Citaat (Scopus)

Uittreksel

Signature extraction is a critical preprocessing step in forensic log analysis because it enables sophisticated analysis techniques to be applied to logs. Currently, most signature extraction frameworks either use rule-based approaches or handcrafted algorithms. Rule-based systems are error-prone and require high maintenance effort. Hand-crafted algorithms use heuristics and tend to work well only for specialized use cases. In this paper we present a novel approach to extract signatures from forensic logs that is based on a neural language model. This language model learns to identify mutable and non-mutable parts in a log message. We use this information to extract signatures. Neural language models have shown to work extremely well for learning complex relationships in natural language text. We experimentally demonstrate that our model can detect which parts are mutable with an accuracy of 86.4%. We also show how extracted signatures can be used for clustering log lines.
TaalEngels
Titel2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania
Plaats van productiePiscataway
UitgeverijInstitute of Electrical and Electronics Engineers
Pagina's1--6
Aantal pagina's6
ISBN van elektronische versie978-1-5090-5835-8
ISBN van geprinte versie978-1-5090-5836-5
DOI's
StatusGepubliceerd - 26 apr 2017

Vingerafdruk

Information use
Knowledge based systems

Citeer dit

Thaler, S. M., Menkovski, V., & Petkovic, M. (2017). Towards a neural language model for signature extraction from forensic logs. In 2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania (blz. 1--6). Piscataway: Institute of Electrical and Electronics Engineers. DOI: 10.1109/ISDFS.2017.7916497
Thaler, S.M. ; Menkovski, V. ; Petkovic, M./ Towards a neural language model for signature extraction from forensic logs. 2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania. Piscataway : Institute of Electrical and Electronics Engineers, 2017. blz. 1--6
@inproceedings{7d8a174fb89743a7a442501c5307f7ec,
title = "Towards a neural language model for signature extraction from forensic logs",
abstract = "Signature extraction is a critical preprocessing step in forensic log analysis because it enables sophisticated analysis techniques to be applied to logs. Currently, most signature extraction frameworks either use rule-based approaches or handcrafted algorithms. Rule-based systems are error-prone and require high maintenance effort. Hand-crafted algorithms use heuristics and tend to work well only for specialized use cases. In this paper we present a novel approach to extract signatures from forensic logs that is based on a neural language model. This language model learns to identify mutable and non-mutable parts in a log message. We use this information to extract signatures. Neural language models have shown to work extremely well for learning complex relationships in natural language text. We experimentally demonstrate that our model can detect which parts are mutable with an accuracy of 86.4{\%}. We also show how extracted signatures can be used for clustering log lines.",
author = "S.M. Thaler and V. Menkovski and M. Petkovic",
year = "2017",
month = "4",
day = "26",
doi = "10.1109/ISDFS.2017.7916497",
language = "English",
isbn = "978-1-5090-5836-5",
pages = "1----6",
booktitle = "2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania",
publisher = "Institute of Electrical and Electronics Engineers",
address = "United States",

}

Thaler, SM, Menkovski, V & Petkovic, M 2017, Towards a neural language model for signature extraction from forensic logs. in 2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania. Institute of Electrical and Electronics Engineers, Piscataway, blz. 1--6. DOI: 10.1109/ISDFS.2017.7916497

Towards a neural language model for signature extraction from forensic logs. / Thaler, S.M.; Menkovski, V.; Petkovic, M.

2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania. Piscataway : Institute of Electrical and Electronics Engineers, 2017. blz. 1--6.

Onderzoeksoutput: Hoofdstuk in Boek/Rapport/CongresprocedureConferentiebijdrageAcademicpeer review

TY - GEN

T1 - Towards a neural language model for signature extraction from forensic logs

AU - Thaler,S.M.

AU - Menkovski,V.

AU - Petkovic,M.

PY - 2017/4/26

Y1 - 2017/4/26

N2 - Signature extraction is a critical preprocessing step in forensic log analysis because it enables sophisticated analysis techniques to be applied to logs. Currently, most signature extraction frameworks either use rule-based approaches or handcrafted algorithms. Rule-based systems are error-prone and require high maintenance effort. Hand-crafted algorithms use heuristics and tend to work well only for specialized use cases. In this paper we present a novel approach to extract signatures from forensic logs that is based on a neural language model. This language model learns to identify mutable and non-mutable parts in a log message. We use this information to extract signatures. Neural language models have shown to work extremely well for learning complex relationships in natural language text. We experimentally demonstrate that our model can detect which parts are mutable with an accuracy of 86.4%. We also show how extracted signatures can be used for clustering log lines.

AB - Signature extraction is a critical preprocessing step in forensic log analysis because it enables sophisticated analysis techniques to be applied to logs. Currently, most signature extraction frameworks either use rule-based approaches or handcrafted algorithms. Rule-based systems are error-prone and require high maintenance effort. Hand-crafted algorithms use heuristics and tend to work well only for specialized use cases. In this paper we present a novel approach to extract signatures from forensic logs that is based on a neural language model. This language model learns to identify mutable and non-mutable parts in a log message. We use this information to extract signatures. Neural language models have shown to work extremely well for learning complex relationships in natural language text. We experimentally demonstrate that our model can detect which parts are mutable with an accuracy of 86.4%. We also show how extracted signatures can be used for clustering log lines.

U2 - 10.1109/ISDFS.2017.7916497

DO - 10.1109/ISDFS.2017.7916497

M3 - Conference contribution

SN - 978-1-5090-5836-5

SP - 1

EP - 6

BT - 2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania

PB - Institute of Electrical and Electronics Engineers

CY - Piscataway

ER -

Thaler SM, Menkovski V, Petkovic M. Towards a neural language model for signature extraction from forensic logs. In 2017 5th International Symposium on Digital Forensic and Security (ISDFS), 26-28 April 2017, Tirgu Mures, Romania. Piscataway: Institute of Electrical and Electronics Engineers. 2017. blz. 1--6. Beschikbaar vanaf, DOI: 10.1109/ISDFS.2017.7916497