Unsupervised signature extraction from forensic logs

Onderzoeksoutput: Hoofdstuk in Boek/Rapport/CongresprocedureConferentiebijdrageAcademicpeer review

1 Citaat (Scopus)

Uittreksel

Signature extraction is a key part of forensic log analysis. It involves recognizing patterns in log lines such that log lines that originated from the same line of code are grouped together. A log signature consists of immutable parts and mutable parts. The immutable parts define the signature, and the mutable parts are typically variable parameter values. In practice, the number of log lines and signatures can be quite large, and the task of detecting and aligning immutable parts of the logs to extract the signatures becomes a significant challenge. We propose a novel method based on a neural language model that outperforms the current state-of-the-art on signature extraction. We use an RNN auto-encoder to create an embedding of the log lines. Log lines embedded in such a way can be clustered to extract the signatures in an unsupervised manner.
TaalEngels
TitelMachine Learning and Knowledge Discovery in Databases
SubtitelEuropean Conference, ECML PKDD 2017, Skopje, Macedonia, September 18–22, 2017, Proceedings, Part III
RedacteurenY. Altun, K. Das, T. Mielikäinen, D. Malerba, J. Stefanowski, J. Read, M. Žitnik, M. Ceci
Plaats van productieDordrecht
UitgeverijSpringer
Pagina's305-316
ISBN van elektronische versie978-3-319-71273-4
ISBN van geprinte versie978-3-319-71272-7
DOI's
StatusGepubliceerd - 2017
EvenementEuropean Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, September 18–22, 2017, Skopje, Macedonia - Skopje, Macedonië
Duur: 18 sep 201722 sep 2017
http://ecmlpkdd2017.ijs.si/index.html

Publicatie series

NaamLNCS
Volume10536

Congres

CongresEuropean Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, September 18–22, 2017, Skopje, Macedonia
Verkorte titelECML PKDD 2017
LandMacedonië
StadSkopje
Periode18/09/1722/09/17
Internet adres

Citeer dit

Thaler, S. M., Menkovski, V., & Petkovic, M. (2017). Unsupervised signature extraction from forensic logs. In Y. Altun, K. Das, T. Mielikäinen, D. Malerba, J. Stefanowski, J. Read, M. Žitnik, ... M. Ceci (editors), Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2017, Skopje, Macedonia, September 18–22, 2017, Proceedings, Part III (blz. 305-316). (LNCS; Vol. 10536). Dordrecht: Springer. DOI: 10.1007/978-3-319-71273-4_25
Thaler, S.M. ; Menkovski, V. ; Petkovic, M./ Unsupervised signature extraction from forensic logs. Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2017, Skopje, Macedonia, September 18–22, 2017, Proceedings, Part III. redacteur / Y. Altun ; K. Das ; T. Mielikäinen ; D. Malerba ; J. Stefanowski ; J. Read ; M. Žitnik ; M. Ceci. Dordrecht : Springer, 2017. blz. 305-316 (LNCS).
@inproceedings{3cc36cad6a224db3bd918d16d16fa71a,
title = "Unsupervised signature extraction from forensic logs",
abstract = "Signature extraction is a key part of forensic log analysis. It involves recognizing patterns in log lines such that log lines that originated from the same line of code are grouped together. A log signature consists of immutable parts and mutable parts. The immutable parts define the signature, and the mutable parts are typically variable parameter values. In practice, the number of log lines and signatures can be quite large, and the task of detecting and aligning immutable parts of the logs to extract the signatures becomes a significant challenge. We propose a novel method based on a neural language model that outperforms the current state-of-the-art on signature extraction. We use an RNN auto-encoder to create an embedding of the log lines. Log lines embedded in such a way can be clustered to extract the signatures in an unsupervised manner.",
author = "S.M. Thaler and V. Menkovski and M. Petkovic",
year = "2017",
doi = "10.1007/978-3-319-71273-4_25",
language = "English",
isbn = "978-3-319-71272-7",
series = "LNCS",
publisher = "Springer",
pages = "305--316",
editor = "Y. Altun and K. Das and T. Mielik{\"a}inen and D. Malerba and J. Stefanowski and J. Read and M. Žitnik and M. Ceci",
booktitle = "Machine Learning and Knowledge Discovery in Databases",
address = "Germany",

}

Thaler, SM, Menkovski, V & Petkovic, M 2017, Unsupervised signature extraction from forensic logs. in Y Altun, K Das, T Mielikäinen, D Malerba, J Stefanowski, J Read, M Žitnik & M Ceci (redactie), Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2017, Skopje, Macedonia, September 18–22, 2017, Proceedings, Part III. LNCS, vol. 10536, Springer, Dordrecht, blz. 305-316, Skopje, Macedonië, 18/09/17. DOI: 10.1007/978-3-319-71273-4_25

Unsupervised signature extraction from forensic logs. / Thaler, S.M.; Menkovski, V.; Petkovic, M.

Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2017, Skopje, Macedonia, September 18–22, 2017, Proceedings, Part III. redactie / Y. Altun; K. Das; T. Mielikäinen; D. Malerba; J. Stefanowski; J. Read; M. Žitnik; M. Ceci. Dordrecht : Springer, 2017. blz. 305-316 (LNCS; Vol. 10536).

Onderzoeksoutput: Hoofdstuk in Boek/Rapport/CongresprocedureConferentiebijdrageAcademicpeer review

TY - GEN

T1 - Unsupervised signature extraction from forensic logs

AU - Thaler,S.M.

AU - Menkovski,V.

AU - Petkovic,M.

PY - 2017

Y1 - 2017

N2 - Signature extraction is a key part of forensic log analysis. It involves recognizing patterns in log lines such that log lines that originated from the same line of code are grouped together. A log signature consists of immutable parts and mutable parts. The immutable parts define the signature, and the mutable parts are typically variable parameter values. In practice, the number of log lines and signatures can be quite large, and the task of detecting and aligning immutable parts of the logs to extract the signatures becomes a significant challenge. We propose a novel method based on a neural language model that outperforms the current state-of-the-art on signature extraction. We use an RNN auto-encoder to create an embedding of the log lines. Log lines embedded in such a way can be clustered to extract the signatures in an unsupervised manner.

AB - Signature extraction is a key part of forensic log analysis. It involves recognizing patterns in log lines such that log lines that originated from the same line of code are grouped together. A log signature consists of immutable parts and mutable parts. The immutable parts define the signature, and the mutable parts are typically variable parameter values. In practice, the number of log lines and signatures can be quite large, and the task of detecting and aligning immutable parts of the logs to extract the signatures becomes a significant challenge. We propose a novel method based on a neural language model that outperforms the current state-of-the-art on signature extraction. We use an RNN auto-encoder to create an embedding of the log lines. Log lines embedded in such a way can be clustered to extract the signatures in an unsupervised manner.

U2 - 10.1007/978-3-319-71273-4_25

DO - 10.1007/978-3-319-71273-4_25

M3 - Conference contribution

SN - 978-3-319-71272-7

T3 - LNCS

SP - 305

EP - 316

BT - Machine Learning and Knowledge Discovery in Databases

PB - Springer

CY - Dordrecht

ER -

Thaler SM, Menkovski V, Petkovic M. Unsupervised signature extraction from forensic logs. In Altun Y, Das K, Mielikäinen T, Malerba D, Stefanowski J, Read J, Žitnik M, Ceci M, redacteurs, Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2017, Skopje, Macedonia, September 18–22, 2017, Proceedings, Part III. Dordrecht: Springer. 2017. blz. 305-316. (LNCS). Beschikbaar vanaf, DOI: 10.1007/978-3-319-71273-4_25