Australian Digital Forensics Conference

Document Type

Conference Proceeding

Publisher

Security Research Institute, Edith Cowan University

Editor(s)

Professor Craig Valli

ISBN

978-0-6484444-0-4

Abstract

Event log parsing is a process to split and label each field in a log entry. Existing approaches commonly use regular expressions or parsing rules to extract the fields. However, such techniques are time-consuming as a forensic investigator needs to define a new rule for each log file type. In this paper, we present a tool, namely nerlogparser, to parse the log entries automatically, where log parsing is modeled as a named entity recognition problem. We use a deep machine learning technique, specifically the bidirectional long short-term memory networks, as the underlying architecture for this purpose. Unlike existing tools, nerlogparser is a fully automatic tool as the investigators do not need to define any parsing rules and it is generic as there is only one model to parse various types of log files. Experimental results show that nerlogparser achieves superior performance compared with other traditional machine learning methods.

Comments

Originally published as: Studiawan, H., Sohel, F., & Payne, C. (2018). Automatic log parser to support forensic analysis. In proceedings of Proceedings of the 16th Australian Digital Forensics Conference (pp. 1-10). Perth, Australia: Edith Cowan University.

DOI

10.25958/5c5268c766686

Share

 
COinS