An Approach to Improving Network Security Using Log Analysis

Marija Zajeganović – The Academy of Technical and Art Applied Studies Belgrade, Department School of Information and
Communication Technologies, Zdravka Čelara 16, Belgrade, 11000, Republic of Serbia

Milan Pavlović – The Academy of Technical and Art Applied Studies Belgrade, Department School of Information and
Communication Technologies, Zdravka Čelara 16, Belgrade, 11000, Republic of Serbia

Danica Mamula Tartalja – The Academy of Technical and Art Applied Studies Belgrade, Department School of Information and Communication Technologies, Zdravka Čelara 16, Belgrade, 11000, Republic of Serbia

Silva Kostić – The Academy of Technical and Art Applied Studies Belgrade, Department School of Information and
Communication Technologies, Zdravka Čelara 16, Belgrade, 11000, Republic of Serbia

Abstract: Troubleshooting is the process of detecting, identifying and re­solving problems within a computer network by means of specific methods, tools and operations. Troubleshooting implies following a set of procedures or steps that conform to the security standards and policies of a company. Diagnosing the source of a problem can be done by tools for system moni­toring, recording log messages, manual testing of device configuration, as well as by tools for device operation analysis. The procedure for using log messages to resolve both common problems and those caused by attacks is explained in this paper. Furthermore, this paper describes the way securi­ty threat management systems use the contents of log messages to analyze hardware problems and malicious activities.

6th International Scientific Conference on Recent Advances in Information Technology, Tourism, Economics, Management and Agriculture – ITEMA 2022 – Conference Proceedings, Hybrid (University of Maribor, Slovenia), October 27, 2022

ITEMA Conference Proceedings published by: Association of Economists and Managers of the Balkans – Belgrade, Serbia

ITEMA conference partners: Faculty of Economics and Business, University of Maribor, Slovenia; Faculty of Organization and Informatics, University of Zagreb, Varaždin; Faculty of Geography, University of Belgrade, Serbia; Institute of Marketing, Poznan University of Economics and Business, Poland; Faculty of Agriculture, Banat’s University of Agricultural Sciences and Veterinary Medicine ”King Michael I of Romania”, Romania

ITEMA Conference 2022 Conference Proceedings: ISBN 978-86-80194-63-9, ISSN 2683-5991, DOI: https://doi.org/10.31410/ITEMA.2022

Creative Commons Non Commercial CC BY-NC: This article is distributed under the terms of the Creative Commons Attribution-Non-Commercial 4.0 License (https://creativecommons.org/licenses/by-nc/4.0/) which permits non-commercial use, reproduction and distribution of the work without further permission. 

References

Bhatt, S., Manadhata, P. K. & Zomlot, L. (2014). The Operational Role of Security Information and Event Management Systems. In IEEE Security & Privacy, vol. 12, no. 5, pp. 35-41, Sept.-Oct. 2014, https://doi.org/10.1109/MSP.2014.103 

Jing, Y., Tingwen, L., Haoliang, Z., Jinqiao, S. & Guo, L. (2015). An automatic approach to extract the formats of network and security log messages. MILCOM 2015 – 2015 IEEE Military Communications Conference, pp. 1542-1547, https://doi.org/10.1109/MILCOM.2015.7357664 

Panek, C. (2020). Networking Fundamentals. by John Wiley & Sons, Inc. ISBN: 978-1-119-65074-4

Ranjbar, A. (2015). Troubleshooting and Maintaining Cisco IP Networks (TSHOOT) Founda­tion Learning Guide, Pearson Education, Inc., ISBN-13: 978-1-58720-455-5

Simpson, M. T., Backman, K., & Corley, J. E. (2011). Hands-On Ethical Hacking And Network Defense. Course Technology, Cengage Learning. ISBN: 978-1-4354-8609-6.

Suh-Lee, C, Ju-Yeon, J., & Yoohwan, K. (2016). Text mining for security threat detection dis­covering hidden information in unstructured log messages. 2016 IEEE Conference on Communications and Network Security (CNS), pp. 252-260, https://doi.org/10.1109/CNS.2016.7860492 

Vaarandi, R., Blumbergs, B., & Kont, M. (2018). An unsupervised framework for detecting anomalous messages from syslog log files. NOMS 2018 – 2018 IEEE/IFIP Network Oper­ations and Management Symposium, pp. 1-6, https://doi.org/10.1109/NOMS.2018.8406283