@inproceedings{ad76e24b8c4b412db0abbb62898f1ca4,
title = "Event Abstration in a Forensic Timeline",
abstract = "Event abstraction is a process of extracting main events from a large set of data, allowing investigators to identify patterns, connections, and anomalies in event logs that may reveal further evidence of malicious activity. In this paper, we investigate the use of event abstraction in a forensic timeline. This work applies the Drain method, a tree-based abstraction approach, and demonstrates its efficiency in producing accurate event abstraction. It also discusses the challenges faced by investigators in event abstraction and its analysis in a forensic timeline. Finally, this paper presents case studies of web server attacks and creates their event abstraction from a forensic timeline.",
keywords = "Drain method, event abstraction, forensic timeline, log parsing",
author = "Hudan Studiawan",
note = "Publisher Copyright: {\textcopyright} The Author(s), under exclusive license to Springer Nature Switzerland AG 2024.; 2nd International Libyan Conference on Information and Communication Technologies, ILCICT 2023 ; Conference date: 04-09-2023 Through 06-09-2023",
year = "2024",
doi = "10.1007/978-3-031-62624-1_10",
language = "English",
isbn = "9783031626234",
series = "Communications in Computer and Information Science",
publisher = "Springer Science and Business Media Deutschland GmbH",
pages = "119--129",
editor = "Benmusa, {Tammam A. T.} and Elbuni, {Mohamed Samir} and Saleh, {Ibrahim M.} and Ashur, {Ahmed S.} and Drawil, {Nabil M.} and Ellabib, {Issmail M.}",
booktitle = "Information and Communications Technologies - 2nd International Libyan Conference, ILCICT 2023, Proceedings",
address = "Germany",
}