Study on Log Analysis Approaches using LANL Host Log Dataset

Modern enterprises collect, process, and analyze security data from various system and network logs. Many studies show that handling large security datasets and detecting anomalies from those are key challenges faced by most of today's enterprises. Unfortunately, we observed that most security professionals are inexperienced at performing data analysis. In this paper, we study published works analyzing one publicly accessible log dataset (referred to as Sandia Dataset) published by Los Alamos National Laboratory. We evaluate their data analysis methodologies and assumptions during the analysis. Our results show that many of the current studies have flaws in their approach which may invalidate their claims or the analysis outcomes.