A Platform for analyzing log files using temporal logic approach: a test case with web server logs

Simple item page
dc.contributor.authorMuema, Peris Ndululu
dc.date.accessioned2018-10-23T08:41:09Z
dc.date.available2018-10-23T08:41:09Z
dc.date.issued2018
dc.descriptionThesis submitted in partial fulfillment of the requirements for the Degree of Master of Science in Information Systems Security (MSc.ISS) at Strathmore Universityen_US
dc.description.abstractWeb logs are a set of recorded events between clients and web servers. Information provided by these events is valuable to computer system administrators, digital forensic investigators and system security personnel during digital investigations. It is important for these entities to understand when certain system events were initiated and by whom. To achieve this, it is fundamental to gather related evidence to the crime from log files. These forensic procedures however pose a major challenge due to large sizes of the web log files, difficulty in understanding and correlating to attack patterns associated to digital crimes. The connections of events that are remotely positioned in the large log files require extensive computational manpower. This dissertation proposes the design, implementation and evaluation of a web log analysis system based on temporal logic and reconstruction. The case study will be on web server misuse. Temporal Logic operators represent system changes over time. The reconstruction of records in web server log files as streams will enable the implementation of temporal logic on the streaming data. The web server attack patterns established will be described by a special subset of temporal logic known as MSFOMTL (Many Sorted First Order Metric Temporal Logic). The attack patterns will be written in a special EPL (Event Processing Language) as queries and be parsed through Esper, a Complex Event Processing (CEP) engine. To ensure the proposed system increases the quality of log analysis process, log analysis will be performed based on a time window mechanism on sorted log files.en_US
dc.identifier.urihttp://hdl.handle.net/11071/5990
dc.language.isoenen_US
dc.publisherStrathmore Universityen_US
dc.subjectweb server logen_US
dc.subjectlog analysisen_US
dc.subjectweb server misuseen_US
dc.subjectmisuse patternsen_US
dc.subjectcomplex event processingen_US
dc.subjectEsperen_US
dc.titleA Platform for analyzing log files using temporal logic approach: a test case with web server logsen_US
dc.typeThesisen_US
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
A Platform for analyzing log files using temporal logic approach a test - case with web server logs.pdf
Size:
12 MB
Format:
Adobe Portable Document Format
Description:
Full-text Thesis 2018
Download
License bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
license.txt
Size:
1.71 KB
Format:
Item-specific license agreed upon to submission
Description:
Download
Collections
MSc.ISS Theses and Dissertations (2018)