A Graph Database-Based Method for Network Log File Analysis

Abstract

It is frequently required to evaluate data acquired from numerous network logs in order to offer a more accurate judgement of the severity of a cyber threat. This may be accomplished by reviewing the data. One example would be the examination of log records produced by command line tools in solitary confinement. In spite of the fact that employing a log management system makes it simpler to identify certain log documents, it might be time-consuming to examine all of them in order to determine the connection(s) between the different types of network activity. To construct these bridges, we may make use of relational databases by, for example, linking the tables by using complicated database queries that make use of a large number of join processes. Recent years have seen a rise in interest in the use of graph databases as a method for the storage and organization of data in preparation for semantic searches.