Welcome to the InfoSci Platform
Reference Hub4
Threat Hunting in Windows Using Big Security Log Data

Threat Hunting in Windows Using Big Security Log Data

Mohammad Rasool Fatemi, Ali A. Ghorbani
Copyright: © 2020 |Pages: 21
ISBN13: 9781522597421|ISBN10: 1522597425|ISBN13 Softcover: 9781522597438|EISBN13: 9781522597445
DOI: 10.4018/978-1-5225-9742-1.ch007
Cite Chapter Cite Chapter

MLA

Fatemi, Mohammad Rasool, and Ali A. Ghorbani. "Threat Hunting in Windows Using Big Security Log Data." Security, Privacy, and Forensics Issues in Big Data, edited by Ramesh C. Joshi and Brij B. Gupta, IGI Global, 2020, pp. 168-188. https://doi.org/10.4018/978-1-5225-9742-1.ch007

APA

Fatemi, M. R. & Ghorbani, A. A. (2020). Threat Hunting in Windows Using Big Security Log Data. In R. Joshi & B. Gupta (Eds.), Security, Privacy, and Forensics Issues in Big Data (pp. 168-188). IGI Global. https://doi.org/10.4018/978-1-5225-9742-1.ch007

Chicago

Fatemi, Mohammad Rasool, and Ali A. Ghorbani. "Threat Hunting in Windows Using Big Security Log Data." In Security, Privacy, and Forensics Issues in Big Data, edited by Ramesh C. Joshi and Brij B. Gupta, 168-188. Hershey, PA: IGI Global, 2020. https://doi.org/10.4018/978-1-5225-9742-1.ch007

Export Reference

Mendeley
Favorite

Abstract

System logs are one of the most important sources of information for anomaly and intrusion detection systems. In a general log-based anomaly detection system, network, devices, and host logs are all collected and used together for analysis and the detection of anomalies. However, the ever-increasing volume of logs remains as one of the main challenges that anomaly detection tools face. Based on Sysmon, this chapter proposes a host-based log analysis system that detects anomalies without using network logs to reduce the volume and to show the importance of host-based logs. The authors implement a Sysmon parser to parse and extract features from the logs and use them to perform detection methods on the data. The valuable information is successfully retained after two extensive volume reduction steps. An anomaly detection system is proposed and performed on five different datasets with up to 55,000 events which detects the attacks using the preserved logs. The analysis results demonstrate the significance of host-based logs in auditing, security monitoring, and intrusion detection systems.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.