Log Analysis Methods Research Articles

Large language model-based optical network log analysis using LLaMA2 with instruction tuning

The optical network encompasses numerous devices and links, generating a significant volume of logs. Analyzing these logs is significant for network optimization, failure diagnosis, and health monitoring. However, the large-scale and diverse formats of optical network logs present several challenges, including the high cost and difficulty of manual processing, insufficient semantic understanding in existing analysis methods, and the strict requirements for data security and privacy. Generative artificial intelligence (GAI) with powerful language understanding and generation capabilities has the potential to address these challenges. Large language models (LLMs) as a concrete realization of GAI are well-suited for analyzing DCI logs, replacing human experts and enhancing accuracy. Additionally, LLMs enable intelligent interactions with network administrators, automating tasks and improving operational efficiency. Moreover, fine-tuning with open-source LLMs protects data privacy and enhances log analysis accuracy. Therefore, we introduce LLMs and propose a log analysis method with instruction tuning using LLaMA2 for log parsing, anomaly detection and classification, anomaly analysis, and report generation. Real log data extracted from the field-deployed network was used to design and construct instruction tuning datasets. We utilized the dataset for instruction tuning and demonstrated and evaluated the effectiveness of the proposed scheme. The results indicate that this scheme improves the performance of log analysis tasks, especially a 14% improvement in exact match rate for log parsing, a 13% improvement in F1-score for anomaly detection and classification, and a 23% improvement in usability for anomaly analysis, compared with the best baselines.

An Intelligent Approach to Automated Operating Systems Log Analysis for Enhanced Security

Self-healing systems have become essential in modern computing for ensuring continuous and secure operations while minimising downtime and maintenance costs. These systems autonomously detect, diagnose, and correct anomalies, with effective self-healing relying on accurate interpretation of system logs generated by operating systems (OSs). Manual analysis of these logs in complex environments is often cumbersome, time-consuming, and error-prone, highlighting the need for automated, reliable log analysis methods. Our research introduces an intelligent methodology for creating self-healing systems for multiple OSs, focusing on log classification using CountVectorizer and the Multinomial Naive Bayes algorithm. This approach involves preprocessing OS logs to ensure quality, converting them into a numerical format with CountVectorizer, and then classifying them using the Naive Bayes algorithm. The system classifies multiple OS logs into distinct categories, identifying errors and warnings. We tested our model on logs from four major OSs; Mac, Android, Linux, and Windows; sourced from Zenodo to simulate real-world scenarios. The model’s accuracy, precision, and reliability were evaluated, demonstrating its potential for deployment in practical self-healing systems.

Integrated petrophysical, sedimentological and well-log study of the Mangahewa Formation, Taranaki Basin, New Zealand

This study aims to address the problem of porosity preservation in the Mangahewa Formation of five main hydrocarbon fields covering onshore and offshore of the Taranaki Basin. An integrated reservoir characterization of the Middle to Late Eocene Mangahewa Formation is achieved through petrophysical evaluation, sedimentological and petrographical descriptions, and well log analysis methods. Petrophysical parameters (porosity and permeability) were acquired from the available core analysis and using mathematical equations to obtain other petrophysical matrices such as normalized porosity index (NPI) and reservoir quality index (RQI). Factors that affected Mangahewa reservoir were studied through thin-section microscopy and well-log analysis helped to measure the reservoir and hydrocarbon potentiality in the Mangahewa Formation. The Mangahewa Formation is dominated by sandstone and a range of marginal to shallow marine facies with varying hydraulic flow units (HFU). The Mangahewa Formation has a high positive correlation in porosity-permeability relationship and has a maximum of 4.67 μm RQI and 20.08 μm FZI (Well Kapuni-14) which reflect potential reservoir. The Mangahewa Formation observed from Wells Kapuni-14, Maui-A1G, McKee-16A, and Mokau-1 are dominated with 59.6%, 56.4%, 79.3%, and 68% of macro- and megapores, respectively. The presence of authigenic clay and calcite cement has greatly reduced the reservoir quality; however, primary and secondary pores are still observed within the Mangahewa sands. Moreover, well log analysis was carried out on four wells in Taranaki Basin, to run a qualitative and quantitative analysis of the Mangahewa reservoir. Eight potential reservoir zones were examined, revealing that the Mangahewa Formation has a very low shale volume of less than 6%, good effective porosity ranging between 11.0% and 13.3%, up to 36.2% of average water saturation and maximum of 69.8% average hydrocarbon saturation. In conclusion, from this comprehensive study, it can be deduced that the Mangahewa Formation possesses fair to good reservoir quality and hydrocarbon potentiality.

A multidisciplinary approach to facies evaluation at regional level using well log analysis, machine learning, and statistical methods

Geological facies evaluation is crucial for the exploration and development of hydrocarbon reservoirs. To achieve accurate predictions of litho-facies in wells, a multidisciplinary approach using well log analysis, machine learning, and statistical methods was proposed for the Lower Indus Basin. The study utilized five supervised machine learning techniques, including Random Forest (FR), Support Vector Machine (SVM), Artificial Neural Network (ANN), Extreme Gradient Boosting (XGB), and Multilayer Perceptron (MLP), to analyse gamma ray, resistivity, density, neutron porosity, acoustic, and photoelectric factor logs. The Concentration-Number (C-N) fractal model approach and log–log plots were also used to define geothermal features. In a study on machine learning models for classifying different rock types in the Sawan field of the Southern Indus Basin, it was discovered that sand (fine, medium and coarse) facies were most accurately classified (87–94%), followed by shale (70–85%) and siltstone facies (65–79%). The accuracy of the machine learning models was assessed using various statistical metrics, such as precision, recall, F1 score, and ROC curve. The study found that all five machine learning methods successfully predicted different litho-facies in the Lower Indus Basin. In particular, sand facies were most accurately classified, followed by shale and siltstone facies. The multilayer perceptron method performed the best overall. This multidisciplinary approach has the potential to save time and costs associated with traditional core analysis methods and enhance the efficiency of hydrocarbon exploration and development.

Software Failure Log Analysis for Engineers—Review

The use of automated methods for log analysis is unavoidable in any large company; therefore, it has attracted attention from engineers and researchers. As a result, the number of articles in the field grows yearly and new approaches are frequently proposed. Unfortunately, published research works only sometimes meet the needs of engineers wishing to apply the methods in real-life systems. A common issue is that the method’s benefits often do not compensate for the effort required for its implementation and maintenance. Therefore, engineers must understand the pros and cons of full-scale applications, including the implementation details and the required effort. This work provides a comprehensive review of automated log analysis methods and aims to offer a guide for software engineers who fix integration and production failures. The article categorizes and provides an overview of existing methods and assesses their implementation and maintenance costs, as well as the feasibility of the methods. The article also identifies and describes the shortcomings of existing methods, including concept drift, which is not addressed with sufficient attention, as well as the lack of online benchmarks and the interpretation of the log sequence as a language, without an in-depth analysis of its properties. Despite growing efforts to provide feasible and widely adopted solutions, many reference implementations are unavailable. Consequently, the time and computation complexities differ between various implementations of the same approaches, making the results of research work difficult to replicate in real-life scenarios.

Power monitoring system log analysis method based on K-Means clustering

The amount of log data of the power monitoring system is very large, and log analysis is difficult, which causes the power monitoring system to take more time to analyze the log, and there are problems such as low recall rate. Based on this, the design of the power monitoring system log analysis based on K-Means clustering method. For log mining and preprocessing, the K-Means clustering algorithm is used to measure the similarity and dissimilarity of the logs, clustering and locating the dominant number of similar logs in all log data, and compiling standardized documents for them, and compiling the After the data is stored, the log template is established to analyze the power monitoring system log, so as to realize the power monitoring system log analysis based on K-Means clustering. The experimental results show that the log analysis method studied effectively improves the analysis efficiency and recall rate, and can accurately analyze the log, find abnormal logs, reduce the number of false alarms, and prove the effectiveness of the log analysis method.

Web Log Analysis and Security Assessment Method Based on Data Mining.

Web content mining describes the classification, clustering, and attribute analysis of a large number of text documents and multimedia files on the web. Special tasks include retrieval of data from the Internet search engine tool W; structured processing and analysis of web data. Today's blog analysis has security concerns. We do experiments to investigate its safety. Through experiments, we draw the following conclusions: (1) Web log extraction can use efficient data mining algorithms to systematically extract logs from web servers, then determine the main access types or interests of users, and then to a certain extent, based on the discovered user patterns, analyze the user's access settings and behavior. (2) No matter in the test set or the mixed test set, the curve value of deep mining is very stable, the curve value has been kept at 0.95, and the curve value of fuzzy statistics method and quantitative statistics method is stable within the interval of 0.90-095. The results also show that the data mining method has the highest identification accuracy and the best security performance. (3) Web usage analysis requires data abstraction for pattern discovery. This data abstraction can be achieved through data preprocessing, which introduces different formats of web server log files and how web server log data is preprocessed for web usage analysis. One of the most critical parts of the web mining field is web log mining. Web log mining can use powerful data mining algorithms to systematically mine the logs in the web server and then learn the user's access or preferred interests and then conduct a certain degree of user preferences and behavior patterns according to the discovered user patterns. Based on the above analysis, the current web log analysis is faced with security problems. We conduct experiments to study to verify the security performance of web logs and draw conclusions through experiments.

СИСТЕМА ИЗМЕРЕНИЯ ЗАЩИЩЕННОСТИ ИНФОРМАЦИИ И ПЕРСОНАЛЬНЫХ ДАННЫХ ДЛЯ УСТРОЙСТВ ИНТЕРНЕТА ВЕЩЕЙ

The purpose of the article: elimination of the gap in existing need in the set of clear and objective security and privacy metrics for the IoT devices users and manufacturers and an absence of such a set incorporating the interconnected security and privacy metrics, the algorithms for their calculation and generation of the integral clear and objective score by the development of the security and privacy measuring system for the IoT devices. Research method: theoretical and system analysis for determination and classification of the security and privacy metrics, semantic analysis for generating of the semantic model of personal data processing scenarios, analytical modeling methods for generating of the attack traces, log analysis methods, statistical methods and machine learning methods for searching of the anomalies in device behavior, development of the database and software implementing the proposed security and privacy measuring system. The result obtained: the security and privacy measuring system for the IoT devices users and manufacturers is proposed. The proposed system allows automated calculation of the security and privacy metrics based on the available data on the device and generation of the integral security and privacy score. The hierarchy of security and privacy metrics is developed in the scope of the proposed system. The proposed metrics are calculated using static and dynamic data on the device and its behavior. Original algorithms for calculation of the outlined metrics are developed, including the algorithms for calculation of the integral security and privacy score. The architecture of the security measuring system is developed. It integrates the components implementing the developed algorithms for metrics calculation. The system operation is demonstrated on the case study. The area of use of the proposed approach - the developed security and privacy measuring system can be used by the IoT devices manufacturers to analyse their security and privacy, and to provide the users with simple and clear security and privacy metrics. Novelty: the hierarchy of static and dynamic security and privacy metrics for the Internet of Things is developed; the approach to security and privacy assessment for the Internet of Things on the basis of the developed metrics and available data is proposed; novel algorithms for metrics calculation are developed; novel algorithms for integral metrics calculation considering available data are developed. Contribution: Fedorchenko E. – development of the approach, metrics hierarchy, and system architecture, problem statement for the components and their development, Novikova E. – the component for calculation of privacy risks, the component for calculation of integral risk scores, Kotenko I. – project management, problem statement, system architecture, Gaifulina D. – the component for event logs processing and integration, Tushkanova O., Murenin I. – the component for calculation of the dynamic risks score using statistical methods and machine learning, Levshun D. – metrics database, the component for calculation of the static risk score, Meleshko A. – the component for readability assessment, Kolomeets M. – the component for privacy risks assessment on the basis of *.apk files, the component for the dynamic risk score calculation considering attacks traces. All authors participated in the writing of the article.

Anomaly detection on software log based on Temporal Memory

For complex system failures, it is necessary to investigate the cause using runtime log data as a clue. The amount of log data output by systems is becoming increasingly large, and there is a need for an automatic log analysis method that can extract only the log data related to the failure. In this study, we propose TM-LAD, a method for automatically detecting log patterns that are different from normal system operation. In our experiments, we compared the performance of anomaly detection with seven existing methods using the loglizer benchmark. The results show that the proposed method has the smallest F-measure of 0.01 standard deviation in the benchmark, and is more robust to changes in the amount of training data than the other methods.

Machine learning based approach for the interpretation of engineering geophysical sounding logs

In this paper, a set of machine learning (ML) tools is applied to estimate the water saturation of shallow unconsolidated sediments at the Bátaapáti site in Hungary. Water saturation is directly calculated from the first factor extracted from a set of direct push logs by factor analysis. The dataset observed by engineering geophysical sounding tools as special variants of direct-push probes contains data from a total of 12 shallow penetration holes. Both one- and two-dimensional applications of the suggested method are presented. To improve the performance of factor analysis, particle swarm optimization (PSO) is applied to give a globally optimized estimate for the factor scores. Furthermore, by a hyperparameter estimation approach, some control parameters of the utilized PSO algorithm are automatically estimated by simulated annealing (SA) to ensure the convergence of the procedure. The result of the suggested ML-based log analysis method is compared and verified by an independent inversion estimate. The study shows that the PSO-based factor analysis aided by hyperparameter estimation provides reliable in situ estimates of water saturation, which may improve the solution of environmental end engineering problems in shallow unconsolidated heterogeneous formations.

Understanding IIIF image usage based on server log analysis

Abstract Numerous libraries and museums have adopted the International Image Interoperability Framework (IIIF) that promotes mutual use of images among different institutions. In a IIIF-compatible digital collection, images are retrieved via IIIF Image API (Application Programming Interface), wherein regions of images can be specified. Thus, it is possible to investigate image usage in detail by examining the image regions that have been requested. In this article, we propose a log analysis method to measure the image usage and to visualize the analysis outcomes. Specifically, we employ the number of accesses to each pixel and visualize the results using heat maps. Given that a pixel is the smallest image unit, we apply herein a fine-grained analysis. The analysis method can be used in different applications including research tools in which researchers examine images and heat maps that show which regions of the images have already been examined by collaborators.

Visual log analysis method for designing individual and organizational BIM skill

Visual log analysis method for designing individual and organizational BIM skill

E-book data mining: real information behavior of university academic community

PurposeThe purpose of this study is to examine the evidence-based use patterns of Higher Education Commission (HEC) subscribed e-books databases by the academic community at institutions of higher education in Pakistan. The study also investigates the differences in usage based on points of access, scholarly disciplines and gender of users.Design/methodology/approachA transaction log analysis (TLA) method was used to explore the use patterns of HEC e-books databases at the University of the Punjab, utilizing the SAWMILL analytical software and MS Excel.FindingsThe results of the study showed that the use of e-books was at a growing stage at the university. Male boarding students of the university were more active users of e-books as compared to their female counterparts. The Central Library of the University of the Punjab, the Department of Zoology and the Institute of Communication Studies were the most frequently used access points for the e-book users, and the Faculties of Sciences, Life Sciences, Economics and Management Sciences had the most active e-book readers. Furthermore, it was found that the HEC e-books databases were only being used during the four months of summer vacations at the university.Research limitations/implicationsThe study provides only descriptive use frequencies rather than a deep log analysis of e-books usage.Practical implicationsThis research provides important practical implications for examining the evidence-based use patterns of e-books databases' users at the higher educational level. The research suggests that HEC should maintain subscriptions of the most required e-books databases and that the information professionals should conduct orientations and information literacy programs to enhance the utilization of these subscribed databases among female boarder students and those faculties where they were being used less frequently.Originality/valueThe study is the second part of the first phase of a Ph.D. project. This is the first large scale study conducted in a developing country which reports the close to actual, approximate use patterns of e-books based on raw transaction logs of local cache servers at the higher academic level.

Integrated analysis of well logs for productivity prediction in sand-shale sequence reservoirs of the Niger Delta—a case study

Work on fluid productivity prediction in the Niger Delta is sparse or even rare because of the need for expensive but limited information from core data, well test data, and nuclear magnetic resonance (NMR) data. Paucity of this information in the study area due to prohibitive cost makes justification of results of fluid productivity predictions very difficult to justify. However, an integrated well log analysis method is applied to three sand-shale sequence reservoirs of the Niger Delta for fluid productivity predictions in this work using basic log suites. This work utilizes irreducible saturation analysis calculated from the Buckles’ method for three (3) reservoirs in Well “AW” and Well “T”. Rock Physics estimates of Poisson’s ratio values and Vp/Vs ratio values allow for fluid type designation from a cross plot of Poisson’s ratio and Vp/Vs ratio; hence, it is possible to interpret gas saturation, brine saturation, and oil saturation for these reservoirs. The Buckle method yields numbers that are used to estimate irreducible water saturation values independently of Archie’s and Archie’s modified equations. In addition, Buckle’s numbers allow for a pore size and grain size forecast for sandstone reservoirs being intercepted within the two wells. For each of these reservoirs, water saturation (Sw) is compared with the irreducible water saturation (Swirr) with the logic that for a reservoir having Swirr > Sw, no water production is expected. Conversely, for Swirr Sw, no water production should be expected. In well “T” reservoirs T1, T2, and T3, all had Swirr > Sw. Hence, this work demonstrated the usefulness and effectiveness of the Buckle’s method in estimating many useful petrophysical parameters to predict reservoir productivity in the studied area, Niger Delta for wells lacking core data, well test data, and NMR data. Field-wide deployment of this technique may help to improve the reduction in oil-related water production and the cost of managing the produced water at the initial stage of production in the Niger Delta in the reservoir.

A Security Log Analysis Scheme Using Deep Learning Algorithm for IDSs in Social Network

Due to the complexity of the social network server system, various system abnormalities may occur and in turn will lead to subsequent system failures and information losses. Thus, to monitor the system state and detect the system abnormalities are of great importance. As the system log contains valuable information and records the system operating status and users’ behaviors, log data in system abnormality detection and diagnosis can ensure system availability and reliability. This paper discloses a log analysis method based on deep learning for an intrusion detection system, which includes the following steps: preprocess the acquired logs of different types in the target system; perform log analysis on the preprocessed logs using a clustering-based method; then, encode the parsed log events into digital feature vectors; use LSTM-based neural network and log collect-based clustering methods to learn the encoded logs to form warning information; lastly, trace the source of the warning information to the corresponding component to determine the point of intrusion. The paper finally implements the proposed intrusion detection method in the server system, thereby improving the system’s security status.

Porosity and Permeability Measurements Integration of The Upper Cretaceous in Balad Field, Central Iraq

The corrected porosity image analysis and log data can be used to build 3D models for porosity and permeability. This can be much realistic porosity obtainable because the core test data is not always available due to high cost which is a challenge for petroleum companies and petrophysists. Thus, this method can be used as an advantage of thin section studies and for opening horizon for more studies in the future to obtain reservoir properties. Seventy-two core samples were selected and the same numbers of thin sections were made from Khasib, Sa`di, and Hartha, formations from Ba-1, Ba-4, and Ba-8 wells, Balad Oilfield in Central Iraq to make a comprehensive view of using porosity image analysis software to determine the porosity. The petrophysical description including porosity image analysis was utilized and both laboratory core test analysis and well log analysis were used to correct and calibrate the results. The main reservoir properties including porosity and permeability were measured based on core samples laboratory analysis. The results of porosity obtained from well log analysis and porosity image analysis method are corrected by using SPSS software; the results revealed good correlation coefficients between 0.684 and 0.872. The porosity range values are 9-16% and 9-27% for Khasib and Sa’di in Ba-1 Well, respectively; 10-21%, 9-25%, and 16-27% for Khasib, Sa’di and Hartha in Ba-4 Well, respectively; and 11-24% and 15-24% for Khasib and Hartha in Ba-8 Well, respectively according to petrographic image analysis. By using the laboratory core analysis, the porosity range values are 12-26% and 17-24% for Khasib and Sa’di in Ba-1 Well, respectively; 6-28% and 14-27% for Sa’di and Hartha in Ba-4 Well, respectively; and 17-19% and 15-24% for Sa’di and Hartha in Ba-8 Well, respectively. Finally, the well log analysis showed that the porosity range values are 11-16% and 7-27% for Khasib and Sa’di in Ba-1 Well, respectively; 4-18%, 21-26%, and 16-19% for Khasib, Sa’di and Hartha in Ba-4 Well, respectively; and 9-24% and 15-23% for Khasib and Hartha in Ba-8 Well, respectively. The permeability range values based on laboratory core analysis are 1.51-8.97 md and 0.29-2.77 md for Khasib and Sa’di in Ba-1 Well, respectively; 0.01-24.5 md and 0.28-6.47 md for Sa’di and Hartha in Ba-4 Well, respectively; and 0.86-2.25 md and 0.23-3.66 for Sa’di and Hartha in Ba-8 Well, respectively.

Research on System Log Analysis Based on Bidirectional LSTM

System logs often record important information in the system and are an important source of information on user behavior, system abnormalities, and system operating conditions. With the stacking of system time and the surge of users, the data generated by the system has also exploded. In order to achieve intelligent system management, this paper proposes a system log analysis method based on bidirectional LSTM. The method uses neural networks to extract keywords and data vectors based on the logs generated by the system, and uses the data sequence corresponding to the keywords as input to make judgments about system abnormalities. The experimental results show that the method can effectively judge the abnormality of the system.

Use patterns of e-journals among the science community: a transaction log analysis

Purpose This study aims to explore the evidence-based patterns of e-journal usage, such as the most used and least used databases, at a public-sector university in Pakistan, by analysing scientists’ usage of databases over time. Design/methodology/approach Through transaction log analysis, the frequencies of page views, sessions, session duration and size of the used data were calculated through SAWMILL software and entered into MS Excel. Findings The results revealed that the broad databases of science and engineering were being used more by users as compared to the narrower e-journal databases. Furthermore, the users were mostly accessing the e-journal databases from the university’s central library and its various academic departments. Early morning hours, working days and start of the academic year were found to be the most active timings of e-journal database utilisation. Practical implications The results of the study will help the Higher Education Commission (HEC) of Pakistan and information professionals in better access management of databases. Originality/value This study was conducted to check the feasibility of a PhD project’s first phase and presents the frequencies of HEC e-journal databases’ usage by using transaction log analysis method. The results will be used in preparing interview guide and sample selection for interview. Other Central Asian studies used COUNTER reports provided by publishers for log analysis instead of using raw log data.

Impacts of gantry angle dependent scanning beam properties on proton PBS treatment

While proton beam models in treatment planning systems are generally assumed invariant with respect to the beam deliveries at different gantry angles. Physical properties of scanning pencil beams can change. The gantry angle dependent properties include the delivered charge to the monitor unit chamber, the spot position and the spot shape. The aim of this study is to investigate the extent of the changes and their dosimetric impacts using historical pencil beam scanning (PBS) treatment data.Online beam delivery records at the time of the patient-specific qualify assurance were retrospectively collected for a total of 34 PBS fields from 28 patients treated at our institution. For each field, proton beam properties at two different gantry angles (the planned and zero gantry angles) were extracted by a newly-developed machine log analysis method and used to reconstruct the delivered dose distributions in the cubic water phantom geometry. The reconstructed doses at the two different angles and a planar dose measurement by a 2D ion-chamber array were compared and the dosimetric impacts of the gantry angle dependency were accessed by a 3D γ-index analysis. In addition, the pencil beam spot size was independently characterized as a function of the gantry angle and the beam energy. The dosimetric effects of the perturbed beam shape were also investigated.Comparisons of spot-by-spot beam positions between both gantry angles show a mean deviation of 0.4 and 0.7 mm and a standard deviation of 0.3 and 0.6 mm for x and y directions, respectively. The delivered giga-protons per spot show a percent mean difference and a standard deviation of 0.01% and 0.3%, respectively, from each planned spot weight. These small deviations lead to an excellent agreement in dose comparisons with an average γ passing rate of 99.1%. When each calculation for both planned and zero gantry angles was compared to the measurement, a high correlation in γ values was also observed, also indicating the dosimetric differences are small when a field is delivered at different gantry angles.Utilizing the online beam delivery records, the gantry angle dependencies of the PBS beam delivery were assessed and quantified. The study confirms the variations of the physical properties to be sufficiently small within the clinical tolerances without taking into account the gantry angle variation.

Log Analysis Using Temporal Logic and Reconstruction Approach: Web Server Case

We present a post-mortem log analysis method based on Temporal Logic (TL), Event Processing Language (EPL), and reconstruction approach. After showing that the proposed method could be adapted to any misuse event or attack, we specifically investigate the case of web server misuses. To this end, we examine 5 different misuses on Wordpress web servers, and generate corresponding log files of these attacks for forensic analysis. Then we establish attack patterns and formalize them by means of a special case of temporal logic, i.e. many sorted first order metric temporal logic (MSFOMTL). Later on, we implement these attack patterns in the EPL, and performed experimental log analysis by using a time window mechanism sliding on sorted log records to evaluate effectiveness and efficacy of our proposed method. We found that our approach is potentially capable of providing a platform where investigators can define/store/share misuse patterns using a common language while providing fast and accurate forensic analysis on large log files.