Network Traffic and Security Event Collecting System

Son, Hee-Seung; Lee, Jin-Heung; Kim, Tae-Yong; Lee, Sang-Gon

doi:10.1007/978-981-287-988-2_48

Cited by 1 publication

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Adopting such an approach shall reduce the confusion associated with the troubleshooting process and reduce the time needed for carrying out this process. Diagnosis and recovery of any problem experienced by a system begins with reviewing the system's log files [2]. These files presents the activity record of the system.…”

Section: Introductionmentioning

confidence: 99%

“…That's attributed to the following reasons: (1) Having various types of logs which list messages with low or high severity [6]. In addition, the type of syslog data is represented in unstructured textual data, and there is a variety of formats and a big volume [7], (2) the increasing number of network elements which indicates that there's a massive volume of complex log data, and thus, it's necessary to extract information accurately and efficiently in order to make correct maintenance decisions, and (3) the log format, which depends on each vendor or service [8]. Thus, classifying syslog messages requires having deep domain knowledge of each log format, and the component of each layer and its potential problems.…”

mentioning

confidence: 99%

See 1 more Smart Citation

Comparative analysis of classification techniques for network fault management

Madi¹,

Jarghon²,

Fazea³

et al. 2020

Turk J Elec Eng & Comp Sci

View full text Add to dashboard Cite

Network troubleshooting is a significant process. Many studies were conducted about it. The first step in the troubleshooting procedures is represented in collecting information. It's collected in order to identify the problems.Syslog messages which are sent by almost all network devices include a massive amount of data that concern the network problems. Based on several studies, it was found that analyzing syslog data (which) can be a guideline for network problems and their causes. The detection of network problems can become more efficient if the detected problems have been classified based on the network layers. Classifying syslog data requires identifying the syslog messages that describe the network problems for each layer. It also requires taking into account the formats of syslog for vendors' devices. The present study aimed to propose a method for classifying the syslog messages which identify the network problem.This classification is conducted based on the network layers. This method uses data mining instrument to classify the syslog messages. The description part of the syslog message was used for carrying out the classification process.The relevant syslog messages were identified. The features were then selected to train the classifiers. Six classification algorithms were learned; LibSVM, SMO, KNN, Naïve Bayes, J48, and Random Forest. A real data set was obtained from an educational network device. This dataset was used for the prediction stage. It was found that that LibSVM outperforms other classifiers in terms of the probability rate of the classified instances where it was in the range of 89.90%-32.80%. Furthermore, the validation results indicate that the probability rate of the correctly classified instances is > 70%.

show abstract

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%