Intrusion Log Parser

1
Intrusion Log Parser

• First Presentation
• 2002.9.23
• Presented by Hyeeun Choi

2
Motivation

• Current Problem
• Current Security System cannot block new kind of
  exploits
• Incidents bring floods of data traffic
• Proposed solution
• Real-time analysis with log of intrusion
  detection sensor
• Log Filtering and compression

3
System Architecture
Intrusion Detection System ( Snort)
Log
DB (mySQL)
Analyzed data
4
Scheduling

• 10.13 Research
• 10.26 System Setting
• Linux, Apache, MySQL, Snort and etc
• 11.30 Implementation
• extracting log and analyzing module
• parser
• DB handling
• 12. 4 Testing Error Correction
• 12.15 Writing

5
References

• Network Intrusion Detection(2ND Edition)
• Intrusion Signatures and Analysis
• Securityfocus http//www.securityfocus.com
• http//www.certcc.or.kr