A Comprehensive Survey of Event Analytics

1. Introduction

An event is an occurrence within a computer system that converses with other systems or users. Computer and network systems contain event logs that holds enormous amount of data. These event logs hold records of any behaviors or actions a network device performs. Events may also involve illegal activities such as malicious attacks or unexpected data movement. The plan is to assemble these events and to examine their relationships with research and recording each activity into a knowledge database. This information will help avoid further incidents or risks after events have occurred.

Event analytics is a complex scheme therefore we have created subcategories for our research. We divided this into four major components: computer event surveillance, computer event monitoring, computer event forensic and computer event security. In this paper, we have combined computer event surveillance and computer event monitoring together and computer event forensic and computer event security together shown on Figure 1. An extensive research was conducted throughout these subcategories. We have selected the articles written by professionals in their respected fields.

Figure 1.

Structure of event analytics

This paper will be divided into four sections: Section 2 will be on state of the arts, which is the highest level of development or technique at this time, a range or systems and techniques will be introduced here. Section 3 will be on existing systems and algorithms. The last section will then be the conclusion that will encapsulate our insights on what was useful and what we have learnt from this research.

2. The State Of The Arts

This section covers the highest level of development of computer analytics; it includes topics such as computer surveillance systems, computer forensic events, monitoring events and network events security related methodologies, which are currently being employed. This section contains up to date ideas and knowledge of computer analytics, which can help to make advancements in already existing methodologies.