Date of Award

2020

Publisher

North Dakota State University

Document Type

Master's Paper

Degree Awarded

Master of Science (MS)

Program

Computer Science

Department

Computer Science

College

Engineering

Faculty Advisor

Denton, Anne

Description

Access log management is an essential part of cybersecurity. Lack of insight into user authentication patterns can hinder readiness and reaction to the growing threat of cyberattacks. Central Authentication Service (CAS) log is underutilized in threat detection due to its detailed and complex logging nature. This paper investigates the feasibility of turning unfriendly CAS logs into helpful datapoints utilizing Elastic Stack (Filebeat, Logstash, Elasticsearch and Kibana) to detect anomalies. CAS logs are collected by Filebeat and forwarded to Logstash. The deployment of a custom Grok filter in Logstash facilitates the normalization of complex CAS logs and the resulting data is indexed in Elasticsearch. A Python program using Elasticsearch’s aggregate function was developed to query the indexed data and compare password and multi-factor submission counts. This mechanism was found to have potential in detecting threats. Finally, Kibana’s rich visualization capabilities allow for exploring and shaping of data in innovative ways.

Rights

NDSU policy 190.6.2

Rights Link

https://www.ndsu.edu/fileadmin/policy/190.pdf

Handle Identifier

https://hdl.handle.net/10365/31678

Download

Share

COinS