Extracting attack manifestations to determine log data requirements for intrusion detection
Paper in proceedings, 2004

Log data adapted for intrusion detection is a little explored research issue despite its importance for successful and efficient detection of attacks and intrusions. This paper presents a starting point in the search for suitable log data by providing a framework for determining exactly which log data that can reveal a specific attack, i.e. the attack manifestations. An attack manifestation consists of the log entries added, changed or removed by the attack compared to normal behaviour. We demonstrate the use of the framework by studying attacks in different types of log data. This work provides a foundation for a fully automated attack analysis. It also provides some pointers for how to define a collection of log elements that are both sufficient and necessary for detection of a specific group of attacks. We believe that this will lead to a log data source that is especially adapted for intrusion detection purposes.

log data

intrusion detection

attack manifestations

data collection


Emilie Lundin Barse

Chalmers, Department of Computer Engineering, Computer Security

Erland Jonsson

Chalmers, Department of Computer Engineering, Computer Security

20th Annual Computer Security Applications Conference (ACSAC 2004)

Subject Categories

Computer and Information Science

More information