Authors:
Jesús Díaz-Verdejo
1
;
Javier Muñoz-Calle
2
;
Rafael Estepa Alonso
2
and
Antonio Estepa Alonso
2
Affiliations:
1
Dpt. of Signal Theory, Telematics and Communications, University of Granada, Granada, Spain
;
2
Dpt. of Telematics Engineering, University of Seville, Seville, Spain
Keyword(s):
Network Security Monitoring, Intrusion Detection Systems, Web Attacks Detection.
Abstract:
InspectorLog is a novel tool for offline analysis of HTTP logs. The tool processes web server logs to identify attacks using diverse rule sets, focusing primarily on the URI field. It is compatible with standard rule formats from systems such as Snort, Nemesida, and ModSecurity. This paper describes InspectorLog functionalities, architecture and applications to the scientific community. We also experimentally validate InspectorLog by comparing its detection power with that of the IDS from which rules are taken. Inspector log fills a gap in available tools in cybersecurity practices in forensic analysis, dataset sanitization, and signature tuning. Future enhancements are planned to support additional Web Application Firewalls (WAFs), new rule types, and HTTP protocol methods, aiming to broaden its scope and utility in the ever-evolving domain of network security.