Dynamic security log processing using deep learning techniques
The result's identifiers
Result code in IS VaVaI
<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26220%2F22%3APU150909" target="_blank" >RIV/00216305:26220/22:PU150909 - isvavai.cz</a>
Alternative codes found
RIV/00216305:26220/22:PU144474
Result on the web
<a href="https://www.eeict.cz/eeict_download/archiv/sborniky/EEICT_2022_sbornik_2_v3_DOI.pdf" target="_blank" >https://www.eeict.cz/eeict_download/archiv/sborniky/EEICT_2022_sbornik_2_v3_DOI.pdf</a>
DOI - Digital Object Identifier
<a href="http://dx.doi.org/10.13164/eeict.2022.184" target="_blank" >10.13164/eeict.2022.184</a>
Alternative languages
Result language
angličtina
Original language name
Dynamic security log processing using deep learning techniques
Original language description
Recently, the number of discovered cyber attacks increases rapidly. Tools for stealing personal data, destroying systems, or controlling infrastructure become continuously sophisticated to achieve malicious aims. Companies are trying to reduce the number of risks on their assets by using various security monitoring devices and tools. SIEM solutions are used for security monitoring, allowing different logs to be correlated. They offer visibility for security teams and allow early response to attacks. The main problem of SIEM software is the implementation of log parsing, which directly influences correlation rules efficiency. Usually, the biggest limitation is parsing dynamic log structures from different event sources. The main contribution of this paper is to apply advanced deep neural networks which use attention mechanisms for efficient log content parsing and its understanding. The proposed question answering model for feature extraction from raw logs should achieve automatic log procession. Obtained results show indisputable advantages of deep attention techniques compared to the common approaches.
Czech name
—
Czech description
—
Classification
Type
D - Article in proceedings
CEP classification
—
OECD FORD branch
20200 - Electrical engineering, Electronic engineering, Information engineering
Result continuities
Project
<a href="/en/project/VI20192022149" target="_blank" >VI20192022149: Distributed detection system for network traffic on L2/L3 according to Regulation No 317/2014 and Act No 181/2014</a><br>
Continuities
P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)
Others
Publication year
2022
Confidentiality
S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů
Data specific for result type
Article name in the collection
Proceedings II of the 28th Conference STUDENT EEICT 2022
ISBN
978-80-214-6030-0
ISSN
—
e-ISSN
—
Number of pages
4
Pages from-to
184-187
Publisher name
Brno University of Technology, Faculty of Electrical Engineering and Communication
Place of publication
Brno
Event location
Brno
Event date
Apr 26, 2022
Type of event by nationality
WRD - Celosvětová akce
UT code for WoS article
—