CORRELATION OF SYSTEM EVENTS: HIGH PERFORMANCE CLASSIFICATION OF SELINUX ACTIVITIES AND SCENARIOS
Jonathan Rouzaud-Cornabas, Patrice Clemente, Christian Toinard · 2008
This paper presents an architecture for the characteri-zation and the classification of activities occurring in a computer. These activities are considered from a system point of view, currently dealing with information coming from SELinux system logs. Starting from system events, and following an incre-mental approach, this paper shows how to characterize high-level and macro activities occuring on the system and how to classify those activities. It gives the formal basics of the approach and presents our implementation. The results of experiments uses real samples taken from our honeypot. Correlation results are obtained using a grid computation. Our high performance architecture en-ables to compute a large amount of events captured dur-ing one year on a high interaction honeypot.