Australian Digital Forensics Conference
Document Type
Conference Proceeding
Publisher
Security Research Institute, Edith Cowan University
Editor(s)
Professor Craig Valli
ISBN
978-0-6484444-0-4
Abstract
Event log parsing is a process to split and label each field in a log entry. Existing approaches commonly use regular expressions or parsing rules to extract the fields. However, such techniques are time-consuming as a forensic investigator needs to define a new rule for each log file type. In this paper, we present a tool, namely nerlogparser, to parse the log entries automatically, where log parsing is modeled as a named entity recognition problem. We use a deep machine learning technique, specifically the bidirectional long short-term memory networks, as the underlying architecture for this purpose. Unlike existing tools, nerlogparser is a fully automatic tool as the investigators do not need to define any parsing rules and it is generic as there is only one model to parse various types of log files. Experimental results show that nerlogparser achieves superior performance compared with other traditional machine learning methods.
DOI
10.25958/5c5268c766686
Comments
Studiawan, H., Sohel, F., & Payne, C. (2018). Automatic log parser to support forensic analysis. In proceedings of Proceedings of the 16th Australian Digital Forensics Conference (pp. 1-10). Perth, Australia: Edith Cowan University.