Virtual Knowledge Graphs for Federated Log Analysis

Virtual Knowledge Graphs for Federated Log Analysis

Abstract

Security professionals rely extensively on log data to monitor IT infrastructures and investigate potentially malicious activities. Existing systems support these tasks by collecting log messages in a database, from where log events can be queried and correlated. Such centralized approaches are typically based on a relational model and store log messages as plain text, which offers limited flexibility for the representation of heterogeneous log events and the connections between them. A knowledge graph representation can overcome such limitations and enable graph pattern-based log analysis, leveraging semantic relationships between objects that appear in heterogeneous log streams. In this paper, we present a method to dynamically construct such log knowledge graphs at query time, i.e., without a priori parsing, aggregation, processing, and materialization of log data. Specifically, we propose a method that – for a given query formulated in SPARQL – dynamically constructs a virtual log knowledge graph directly from heterogeneous raw log files across multiple hosts and contextualizes the result with internal and external background knowledge. We evaluate the approach across multiple heterogeneous log sources and machines and see encouraging results that indicate that the approach is viable and facilitates ad-hoc graph-analytic queries in federated settings.

Grafik Top
Authors
  • Kurniawan, Kabul
  • Ekelhart, Andreas
  • Kiesling, Elmar
  • Winkler, Dietmar
  • Quirchmayr, Gerald
  • Tjoa, A Min
Grafik Top
Shortfacts
Category
Paper in Conference Proceedings or in Workshop Proceedings (Paper)
Event Title
ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna, Austria, August 17-20, 2021
Divisions
Multimedia Information Systems
Event Location
Vienna, Austria (online)
Event Type
Conference
Event Dates
17-20 Aug 2021
Series Name
ARES 21: Proceedings of the 16th International Conference on Availability, Reliability and Security
ISSN/ISBN
978-1-4503-9051-4
Publisher
ACM
Page Range
pp. 1-11
Date
August 2021
Official URL
https://doi.org/10.1145/3465481.3465767
Export
Grafik Top