Rough Logs: A Data Reduction Approach for Log Files

Michael Meinig, Peter Tröger, Christoph Meinel

2019

Abstract

Modern scalable information systems produce a constant stream of log records to describe their activities and current state. This data is increasingly used for online anomaly analysis, so that dependability problems such as security incidents can be detected while the system is running. Due to the constant scaling of many such systems, the amount of processed log data is a significant aspect to be considered in the choice of any anomaly detection approach. We therefore present a new idea for log data reduction called ‘rough logs’. It utilizes rough set theory for reducing the number of attributes being collected in log data for representing events in the system. We tested the approach in a large case study - the experiments showed that data reduction possibilities proposed by our approach remain valid even when the log information is modified due to anomalies happening in the system.

Paper Citation

in Harvard Style

Meinig M., Tröger P. and Meinel C. (2019). Rough Logs: A Data Reduction Approach for Log Files.In Proceedings of the 21st International Conference on Enterprise Information Systems - Volume 2: ICEIS, ISBN 978-989-758-372-8, pages 295-302. DOI: 10.5220/0007735102950302

in Bibtex Style

@conference{iceis19,
author={Michael Meinig and Peter Tröger and Christoph Meinel},
title={Rough Logs: A Data Reduction Approach for Log Files},
booktitle={Proceedings of the 21st International Conference on Enterprise Information Systems - Volume 2: ICEIS,},
year={2019},
pages={295-302},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0007735102950302},
isbn={978-989-758-372-8},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 21st International Conference on Enterprise Information Systems - Volume 2: ICEIS,
TI - Rough Logs: A Data Reduction Approach for Log Files
SN - 978-989-758-372-8
AU - Meinig M.
AU - Tröger P.
AU - Meinel C.
PY - 2019
SP - 295
EP - 302
DO - 10.5220/0007735102950302