short-paper

LogBug: Generating Adversarial System Logs in Real Time

Authors:

Yuan HongAuthors Info & Claims

CIKM '20: Proceedings of the 29th ACM International Conference on Information & Knowledge Management

Pages 2229 - 2232

https://doi.org/10.1145/3340531.3412165

Published: 19 October 2020 Publication History

Abstract

Log parsers first convert large-scale and unstructured system logs into structured data, and then cluster them into groups for anomaly detection and monitoring. However, the security vulnerabilities of the log parsers have not been unveiled yet. In this paper, to our best knowledge, we take the first step to propose a novel real-time black-box attack framework LogBug in which attackers slightly modify the logs to deviate the analysis result (i.e., evading the anomaly detection) without knowing the learning model and parameters of the log parser. We have empirically evaluated LogBug on five emerging log parsers using system logs collected from five different systems. The results demonstrate that LogBug can greatly reduce the accuracy of log parsers with minor perturbations in real time.

Supplementary Material

MP4 File (3340531.3412165.mp4)

In this video, we present a novel black-box attack (?LogBug?) to subvert a series of log parsers which detect anomalies from system logs. The real-time anomaly detection of the log parsers can be significantly deviated by slightly modifying the input system logs without knowing the learning models and parameters of the log parsers. We have evaluated the performance of LogBug by attacking five emerging log parsers (SPELL, LFA, Drain, LenMa, and SHISO) in five different systems (Apache, Android, Linux, Spark, and Mac). The experimental results demonstrate that LogBug can greatly reduce the accuracy of log parsers with minor perturbations on inputs logs in real time.

Download
11.35 MB

References

[1]

Min Du and Feifei Li. Spell: Streaming parsing of system event logs. In IEEE ICDM, Barcelona, Spain, pages 859--864, 2016.

[2]

Qiang Fu, Jian-Guang Lou, Yi Wang, and Jiang Li. Execution anomaly detection in distributed systems through unstructured log analysis. In Proceedings of IEEE ICDM, pages 149--158, 2009.

Digital Library

[3]

Pinjia He, Jieming Zhu, Zibin Zheng, and Michael R. Lyu. Drain: An online log parsing approach with fixed depth tree. In IEEE ICWS, pages 33--40, 2017.

[4]

Daniel S. Hirschberg. Serial computations of levenshtein distances. In Pattern Matching Algorithms, pages 123--141. 1997.

Digital Library

[5]

George Lee, Jimmy J. Lin, Chuang Liu, Andrew Lorek, and Dmitriy V. Ryaboy. The unified logging infrastructure for data analytics at twitter. PVLDB, 2012.

Digital Library

[6]

Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversarial text against real-world applications. NDSS, 2019.

[7]

Shasha Li, Ajaya Neupane, Sujoy Paul, Chengyu Song, Srikanth V. Krishnamurthy, Amit K. Roy-Chowdhury, and Ananthram Swami. Stealthy Adversarial Perturbations Against Real-Time Video Classification Systems. NDSS, 2019.

[8]

Jian-Guang Lou, Qiang Fu, Shengqi Yang, Ye Xu, and Jiang Li. Mining invariants from console logs for system problem detection. In USENIX ATC, 2010.

[9]

Adetokunbo Makanju, A. Nur Zincir-Heywood, and Evangelos E. Milios. Clustering event logs using iterative partitioning. In KDD, pages 1255--1264, 2009.

Digital Library

[10]

Salma Messaoudi, Annibale Panichella, Domenico Bianculli, Lionel C. Briand, and Raimondas Sasnauskas. A search-based approach for accurate identification of log message formats. In Proc ICPC, Gothenburg, Sweden, pages 167--177, 2018.

Digital Library

[11]

Takeru Miyato, Andrew M. Dai, and Ian J. Goodfellow. Adversarial training methods for semi-supervised text classification. In ICLR, 2017.

[12]

Masayoshi Mizutani. Incremental mining of system log format. In IEEE Int. Conf. on SCC, Santa Clara, USA, 2013.

Digital Library

[13]

Meiyappan Nagappan and Mladen A. Vouk. Abstracting log lines to log event types for mining software system logs. In Proc. MSR (Co-located with ICSE), 2010.

[14]

Juan Ramos. Using tf-idf to determine word relevance in document queries. In ICML, 2003.

[15]

Suranjana Samanta and Sameep Mehta. Towards crafting text adversarial samples. CoRR, abs/1707.02812, 2017.

[16]

Keiichi Shima. Length matters: Clustering system log messages using length of words. CoRR, abs/1611.03213, 2016.

[17]

Liang Tang, Tao Li, and Chang-Shing Perng. Logsig: generating system events from raw textual logs. In CIKM, 2011.

[18]

Yinfei Yang and Chris Tar. Google AI Blog, 2018.

[19]

Jieming Zhu, Shilin He, Jinyang Liu, Pinjia He, Qi Xie, Zibin Zheng, and Michael R. Lyu. Tools and benchmarks for automated log parsing. In ICSE-SEIP, 2019.

Digital Library

Cited By

Partovian SFlammini FBucaioni A(2024)Leveraging GANs to Generate Synthetic Log Files for Smart-Troubleshooting in Industry 4.02024 50th Euromicro Conference on Software Engineering and Advanced Applications (SEAA)10.1109/SEAA64295.2024.00079(475-482)Online publication date: 28-Aug-2024
https://doi.org/10.1109/SEAA64295.2024.00079
Batoun MSayagh MAghili ROuni ALi H(2024)A literature review and existing challenges on software logging practicesEmpirical Software Engineering10.1007/s10664-024-10452-w29:4Online publication date: 18-Jun-2024
https://doi.org/10.1007/s10664-024-10452-w
Bin Lashram AHsairi LAl Ahmadi H(2023)HCLPars: Α New Hierarchical Clustering Log Parsing MethodEngineering, Technology & Applied Science Research10.48084/etasr.601313:4(11130-11138)Online publication date: 9-Aug-2023
https://doi.org/10.48084/etasr.6013
Show More Cited By

Index Terms

LogBug: Generating Adversarial System Logs in Real Time
1. Computing methodologies
  1. Machine learning
2. Security and privacy

Recommendations

Certifiable Black-Box Attacks with Randomized Adversarial Examples: Breaking Defenses with Provable Confidence
CCS '24: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security

Black-box adversarial attacks have demonstrated strong potential to compromise machine learning models by iteratively querying the target model or leveraging transferability from a local surrogate model.Recently, such attacks can be effectively mitigated ...
IDSGAN: Generative Adversarial Networks for Attack Generation Against Intrusion Detection
Advances in Knowledge Discovery and Data Mining
Abstract
As an essential tool in security, the intrusion detection system bears the responsibility of the defense to network attacks performed by malicious traffic. Nowadays, with the help of machine learning algorithms, intrusion detection systems develop ...
Disappeared Face: A Physical Adversarial Attack Method on Black-Box Face Detection Models
Information and Communications Security
Abstract
Face detection is a classical problem in the field of computer vision. It has significant application value in face recognition and face recognition related applications such as face-scan payment, identity authentication, and other areas. The ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

CIKM '20: Proceedings of the 29th ACM International Conference on Information & Knowledge Management

October 2020

3619 pages

ISBN:9781450368599

DOI:10.1145/3340531

General Chairs:
Mathieu d'Aquin
DSI, Insight, NUI Galway, Ireland
,
Stefan Dietze
GESIS, Cologne, Germany, Heinrich-Heine-University Düsseldorf, Germany, L3S Research Center, Germany
,
Program Chairs:
Claudia Hauff
TU Delft, The Netherlands
,
Edward Curry
DSI, Insight, NUI Galway, Ireland
,
Philippe Cudre Mauroux
eXascale, University of Fribourg, Switzerland

Copyright © 2020 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 19 October 2020

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Short-paper

Funding Sources

National Science Foundation

Conference

CIKM '20

Sponsor:

CIKM '20: The 29th ACM International Conference on Information and Knowledge Management

October 19 - 23, 2020

Virtual Event, Ireland

Acceptance Rates

Overall Acceptance Rate 1,861 of 8,427 submissions, 22%

Upcoming Conference

CIKM '25

Sponsor:
sigir
sigir

The 34th ACM International Conference on Information and Knowledge Management

November 10 - 14, 2025

Seoul , Republic of Korea

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

6
Total Citations
View Citations
244
Total Downloads

Downloads (Last 12 months)33
Downloads (Last 6 weeks)1

Reflects downloads up to 01 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Partovian SFlammini FBucaioni A(2024)Leveraging GANs to Generate Synthetic Log Files for Smart-Troubleshooting in Industry 4.02024 50th Euromicro Conference on Software Engineering and Advanced Applications (SEAA)10.1109/SEAA64295.2024.00079(475-482)Online publication date: 28-Aug-2024
https://doi.org/10.1109/SEAA64295.2024.00079
Batoun MSayagh MAghili ROuni ALi H(2024)A literature review and existing challenges on software logging practicesEmpirical Software Engineering10.1007/s10664-024-10452-w29:4Online publication date: 18-Jun-2024
https://doi.org/10.1007/s10664-024-10452-w
Bin Lashram AHsairi LAl Ahmadi H(2023)HCLPars: Α New Hierarchical Clustering Log Parsing MethodEngineering, Technology & Applied Science Research10.48084/etasr.601313:4(11130-11138)Online publication date: 9-Aug-2023
https://doi.org/10.48084/etasr.6013
Huang SLiu YFung CWang HYang HLuan Z(2023)Improving Log-Based Anomaly Detection by Pre-Training Hierarchical TransformersIEEE Transactions on Computers10.1109/TC.2023.325751872:9(2656-2667)Online publication date: 1-Sep-2023
https://doi.org/10.1109/TC.2023.3257518
Huang SLiu YFung CYang HLuan Z(2022)Black-box Attacks to Log-based Anomaly Detection2022 18th International Conference on Network and Service Management (CNSM)10.23919/CNSM55787.2022.9964935(310-316)Online publication date: 31-Oct-2022
https://doi.org/10.23919/CNSM55787.2022.9964935
Xie SWang HKong YHong Y(2022)Universal 3-Dimensional Perturbations for Black-Box Attacks on Video Recognition Systems2022 IEEE Symposium on Security and Privacy (SP)10.1109/SP46214.2022.9833776(1390-1407)Online publication date: May-2022
https://doi.org/10.1109/SP46214.2022.9833776

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten