Tracking attacks data through log files using mapreduce

Abstract

In this paper, we propose a methodology of security analysis that aims to apply Big Data techniques, such as MapReduce, over several system log files in order to locate and extract data probably related to attacks. These data will lead, through a process of analysis, to identify attacks or detect intrusions. We have illustrated this approach through a concrete case study on exploiting access log files of web apache servers to detect SQLI and DDOS attacks. The obtained results are promising; we are able to extract malicious indicators and events that characterize the intrusions, which help us to make an accurate diagnosis of the system security.