[logs] Data mining

Previous message: Andrea Barisani: "[logs] tenshi 0.5 released"
Next in thread: Chris Brenton: "[logs] Re: Data mining"
Reply: Chris Brenton: "[logs] Re: Data mining"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

devdas@private

Does anyone have suggestions for data mining of logs for security
issues?

I am looking at a few gigabytes of daily logs (about 1.5 terabyte/month)
to be analysed for long term patterns (in particular, trying to detect
botnets and zombied hosts which are trying to look normal by sending
out only a few messages a day).

Being able to detect dynamic IP blocks based on such patterns would be
nice as well.

Devdas Bhagat
_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis