Development and Evaluation of a Dataset Generator Tool for Generating Synthetic Log Files Containing Computer Attack Signatures

2.1. Types of Log File Represented by the Tool

The tool uses two different log file types to represent the attack signatures. The first type, the firewall log, records network activity to and from a host machine. The firewall log can serve as a critical component of information security, as it can be used to identify unusual or unexpected traffic patterns on a local network (Stingley, 2009). The second type, the Common Log Format log or CLF log, is the type of log file present on Web servers such as Apache or IIS and typically log a history of page requests to the server. Many differing types of computer attack signatures can be identified in this log.

Both of these log file types are ranked in the “Top 5 Essential Log Reports” by SANS (Brenton, Bird, & Ranum, 2006) and for this reason were chosen to represent the attack signatures replicated by the tool.

2.2. Categories of Attack Types

There are countless different types of attacks that are afflicted on computers and computer networks. Loosely, these attacks can be categorised as either passive or active. Passive attacks are those in which the attacker monitors transmissions and accesses data without modifying the data in any way. A passive attacker does not want the victim to know they are being attacked. Active attacks on the other hand involve the motoring and accessing of data like passive attacks, but the data is also modified in the process, to either cause malicious damage or to make some kind of gain for the attacker, whether it’s financial or otherwise (Asgaut Eng., 1996).