A Dynamically Configurable Log-Based Distributed Security Event Detection Methodology Using Simple Event Correlator

<p>This research effort identifies attributes of distributed event correlation which make it desirable for security event detection and evaluates those attributes in a comparison with a centralized alternative. Event correlation is an effective means of detecting complex situations encountered in information technology environments. Centralized database-driven log event correlation is more commonly implemented but suffers from flaws such as high network bandwidth utilization significant requirements for system resources and difficulty in detecting certain suspicious behaviors. This analysis measures the value in distributed event correlation by considering network bandwidth utilization detection capability and database query efficiency as well as through the implementation of remote configuration scripts and correlation of multiple log sources. These capabilities produce a configuration which allows a 99% reduction of network syslog traffic in the low-accountability case and a significant decrease in database execution time through context-addition in the high-accountability case.</p><p>This work has been selected by scholars as being culturally important and is part of the knowledge base of civilization as we know it. This work was reproduced from the original artifact and remains as true to the original work as possible. Therefore you will see the original copyright references library stamps (as most of these works have been housed in our most important libraries around the world) and other notations in the work.</p><p>This work is in the public domain in the United States of America and possibly other nations. Within the United States you may freely copy and distribute this work as no entity (individual or corporate) has a copyright on the body of the work.</p><p>As a reproduction of a historical artifact this work may contain missing or blurred pages poor pictures errant marks etc. Scholars believe and we concur that this work is important enough to be preserved reproduced and made generally available to the public. We appreciate your support of the preservation process and thank you for being an important part of keeping this knowledge alive and relevant.</p><br>