Re: [logs] Logging: World Domination

Previous message: Chris Adams: "Re: [logs] tokens and layouts..."
In reply to: Rene Pfeiffer: "Re: [logs] Logging: World Domination"
Next in thread: Tina Bird: "Re: [logs] Logging: World Domination"
Next in thread: copelandtat_private: "RE: [logs] Logging: World Domination"
Reply: Tina Bird: "Re: [logs] Logging: World Domination"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

raistlinat_private

> Since I have a background in physics I am not sure whether we can define
> state changes for applications or operating systems.

We can surely DEFINE state changes for any computer application. If we can
deduce WHEN the state changes by observing the log messages, is a simple
matter of how the former relates to the latter.

Perhaps some hints on the definitions of "state" in a security-related term
can be drawn from the scientific papers describin STAT, an intrusion
detection system developed at UCSB. Look it up.

Stefano "Raistlin" Zanero
System Administrator Gioco.Net
public PGP key block at http://gioco.net/pgpkeys

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
https://lists.shmoo.com/mailman/listinfo/loganalysis