Threat-hunting in Windows environment using host-based log data
| dc.contributor.advisor | Ghorbani, Ali | |
| dc.contributor.author | Fatemi, Mohammad Rasool | |
| dc.date.accessioned | 2023-03-01T16:25:15Z | |
| dc.date.available | 2023-03-01T16:25:15Z | |
| dc.date.issued | 2019 | |
| dc.date.updated | 2023-03-01T15:02:10Z | |
| dc.description.abstract | In a general log-based anomaly detection system, network, devices and host logs are all used together for analysis and the detection of anomalies. However, the ever-increasing volume of logs remains as one of the main challenges that anomaly detection tools face. This thesis proposes a host-based log analysis system that detects anomalies without using network logs to reduce the volume and to show the importance of host-based logs. A parser is implemented to parse and extract features from Sysmon logs and use them to perform detection methods on the data. The valuable information is successfully retained after two extensive volume reduction steps. An anomaly detection system is proposed and performed on different datasets with up to 55,000 events and over a million log messages. The system easily detects the attacks and malicious activities using the preserved logs. The analysis results demonstrate the significance of host-based logs in auditing, security monitoring, and intrusion detection systems. | |
| dc.description.copyright | ©Mohammad Rasool Fatemi, 2020 | |
| dc.description.note | Electronic Only. | |
| dc.format | text/xml | |
| dc.format.extent | xiii, 97 pages | |
| dc.identifier.uri | https://unbscholar.lib.unb.ca/handle/1882/13796 | |
| dc.language.iso | en_CA | |
| dc.publisher | University of New Brunswick | |
| dc.rights | http://purl.org/coar/access_right/c_abf2 | |
| dc.subject.discipline | Computer Science | |
| dc.title | Threat-hunting in Windows environment using host-based log data | |
| dc.type | master thesis | |
| thesis.degree.discipline | Computer Science | |
| thesis.degree.fullname | Master of Computer Science | |
| thesis.degree.grantor | University of New Brunswick | |
| thesis.degree.level | masters | |
| thesis.degree.name | M.C.S. |
Files
Original bundle
1 - 1 of 1