Year: 2020
Type: dissertation
Abstract: Attacks on an operating system have become a significant and increasingly common problem.This type of security incident is recorded in forensic artifacts, such as log files.Forensic investigators will generally examine the logs to analyze such incidents.An anomaly is highly correlated to an attacker's attempts to compromise the system.This thesis proposes a novel framework to automatically detect an anomaly in a forensic timeline constructed from log files.Before identifying anomalies, an automatic log parser is built so that the investigators do not need to define a rule-based parser.Parsing is modeled as named entity recognition problem and a deep learning technique, namely the bidirectional long short-term memory, is exploited to parse log entries.This thesis proposes three major methods as the base of the framework.First, a method for automatic cluster-based anomaly detection is proposed.The anomaly decision is made based on the estimated threshold derived from the clustering results.It considers several A/Prof.Ferdous has provided incredible support assisting me to manage the research, to understand how to propose a novel idea in an academic paper, and to write papers that would be accepted for publication.Dr. Christian helped me to develop the critical thinking skills required for research.Back in 2016, when no one
Author: Hudan Studiawan
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W3125086909