A SURVEY OF NETWORK SERVICE LOG PROCESSING PLATFORMS AND TECHNIQUES FOR THE DETECTION OF INFORMATION INSECURITY RISKS - Phạm Duy Lộc; Hoàng Xuân Dậu (Tạp chí Khoa học Đại học Đà Lạt)
In the layers of information security measures, the monitoring and detection measures of anomalous activities and information insecurity risks are considered the second defense layer behind firewalls and access controls. This defense layer includes intrusion detection and prevention systems for hosts and networks. This paper examines platforms, tools and techniques for processing and analyzing access logs of network service servers for the detection of anomalous activities and information insecurity risks. Based on the survey results, the paper proposes the architecture of the monitoring and information security insurance system for small and medium-sized networks of organizations with limited resources.