Security Basics: RE: Any research on log correlation and aggregation?

["Andrew Chong" <andrewjw () singnet com sg>]

A good Security Log Management book (Identifying Patterns in Chaos).
http://www.sweetfantasy.biz/prod_details.aspx?AsinSearch=1597490423&type
=heavy&f=xml

Regards,
Andrew Chong, cissp
-----Original Message-----
From: ricci [mailto:ricci () cs ust hk] 
Sent: Friday, October 28, 2005 8:55 AM
To: security-basics () securityfocus com
Subject: Any research on log correlation and aggregation?


Hello All,

I'm read some research paper about log correlation and aggregation of
various logging facilities such as syslog, IDS and Firewall logs. Is
there any research on correlation and aggregation? Is there any research
on log aggregation through timestamp and any research on time
synchronization? Is there any mechanism for correlating and aggregating
logs which do not have time synchronization?

Thx.

Ricci