The Research and Realization of a Kind of Log Management-Oriented Descriptive Language to Describe the Security of Computer Network

Abstract:

Network Security Logs are the records of the important activities and changes of the network, which not only records the state changes of network or mainframe at any time, but also provides the data bases for the network administrators to conduct network management. How to obtain the effective information of security events from the logs with different formats, thus realizing the detection, analysis and evaluation of the security events, has always been the key point to improve the important content of information security protection and focused on by the network administrators. The paper presents a kind of descriptive language of computer network security focusing on the log management, which realizes the uniform description of the common logs in the network with its effectiveness being verified in the actual network environment. It provides the infrastructural support to improve the early warning capacity towards the information security events.

• Periodical: Applied Mechanics and Materials (Volumes 556-562)
• Pages: 5765-5770
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.556-562.5765
• Online since: May 2014
• Authors: Yan Li Lv*, Yuan Long Li, Shuang Xiang, Chun He Xia
• Keywords: Correlation, Description Language, Logs, Security Event

References

[1] Cohen, F., Information system attacks: A preliminary classification scheme. Computers & Security, Journal Vol. 16(1)(1997): pp.29-46.

DOI: 10.1016/s0167-4048(97)85785-9

[2] Schultz, E.E. and R. Shumway, Incident Response. 2003, Sams Publisher(2003).

[3] Stallings, W., Network and internetwork security: principles and practice. 1995: Prentice-Hall, Inc.

[4] Neumann, P.G. and D.B. Parker. A summary of computer misuse techniques. in Proceedings of the 12th National Computer Security Conference( 1989).

[5] Howard, J.D., An analysis of security incidents on the Internet 1989-1995. DTIC Document(1997).

[6] Goldberg, K., et al. Desktop teleoperation via the world wide web. in Robotics and Automation, 1995. Proceedings., IEEE International Conference (1995).

DOI: 10.1109/robot.1995.525358

[7] Icove, D., K. Seger and W. VonStorch, Computer crime: a crimefighter's handbook. 1995: O'Reilly & Associates Sebastopol, CA.

[8] Howard, J.D. and T.A. Longstaff, A common language for computer security incidents. Sandia Report: SAND98-8667, Sandia National Laboratories, http: /www. cert. org/research/taxonomy_988667. pdf, (1998).

[9] WANG Wen-xia, et al, An Expert System Based on Network Security Event Correlation, Netinfo Security, 2011. 9:P. 97-100.

[10] TERENA–IODEF Worki et alL.J.G. Villalba, Data model extension for security event notification with dynamic risk assessment purpose. Science China Information Sciences, 2013. 56(11): pp.1-9.

DOI: 10.1007/s11432-013-5018-z