Virtual Knowledge Graphs for Federated Log Analysis
| Autor: | Kabul Kurniawan, Elmar Kiesling, Gerald Quirchmayr, A Min Tjoa, Andreas Ekelhart, Dietmar Winkler |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2021 |
| Předmět: |
Theoretical computer science
Parsing 509018 Knowledge management Plain text Computer science 505002 Data protection computer.file_format Construct (python library) computer.software_genre 509018 Wissensmanagement Relational model SPARQL Graph (abstract data type) A priori and a posteriori 505002 Datenschutz Representation (mathematics) computer MathematicsofComputing_DISCRETEMATHEMATICS |
| Zdroj: | ARES |
| Popis: | Security professionals rely extensively on log data to monitor IT infrastructures and investigate potentially malicious activities. Existing systems support these tasks by collecting log messages in a database, from where log events can be queried and correlated. Such centralized approaches are typically based on a relational model and store log messages as plain text, which offers limited flexibility for the representation of heterogeneous log events and the connections between them. A knowledge graph representation can overcome such limitations and enable graph pattern-based log analysis, leveraging semantic relationships between objects that appear in heterogeneous log streams. In this paper, we present a method to dynamically construct such log knowledge graphs at query time, i.e., without a priori parsing, aggregation, processing, and materialization of log data. Specifically, we propose a method that – for a given query formulated in SPARQL – dynamically constructs a virtual log knowledge graph directly from heterogeneous raw log files across multiple hosts and contextualizes the result with internal and external background knowledge. We evaluate the approach across multiple heterogeneous log sources and machines and see encouraging results that indicate that the approach is viable and facilitates ad-hoc graph-analytic queries in federated settings. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|