Incident detection
Thursday, February 24, 2011
10:43 AM
Security incident detection:
Input: log entries from a set of machines. 
Output: suspicious behaviors detected. 
UDF: Parse log entries, select failed password attempts. 
Suspicious pattern to detect: 
bot password cracking attack,
many source locations, 
one user, 
many login failures, 
distributed in time.  
Very difficult to detect by standard log scanning methods: 
Distributed cracking attempts, 
long time-scale,  
huge data scale. 