Computer Sciences Commons^™

Kerf: Machine Learning To Aid Intrusion Analysts, Javed Aslam, Sergey Bratus, David Kotz, Ron Peterson, Daniela Rus

Dartmouth Scholarship

Kerf is a toolkit for post-hoc intrusion analysis of available system logs and some types of network logs. It takes the view that this process is inherently interactive and iterative: the human analyst browses the log data for apparent anomalies, and tests and revises his hypothesis of what happened. The hypothesis is alternately refined, as information that partially confirms the hypothesis is discovered, and expanded, as the analyst tries new avenues that broaden the investigation.