Adding value to log event correlation using distributed techniques
Justin Myers, Michael R. Grimaila, Robert F. Mills · 2010
Log management and monitoring activities have traditionally proved very useful in detecting system and network faults. Increasingly, log monitoring has also been recognized for its value in detecting and thwarting malicious behavior on systems and the network. Unfortunately, the centralized methodologies for conducting log monitoring are often not well suited to today's enterprise environment. In this paper, we discuss our ongoing research into distributed event correlation of web server logs. The application of these distributed techniques in conjunction with existing log monitoring methodologies can provide value over centralized approaches by making malicious behavior detection more efficient and effective.