Anomaly Detection on Firewall Logs from Multifold System Based on Email Classification

Abstract

Most of the existing systems categorize the document or firewall logs-corpus based on the term similarity by find the document-term relationship. It cannot identify the conceptual similarity or correlation among them. But proposed system focuses on both term wise as well as conceptual wise similarity to find the firewall logs statistics to tag the firewall logs with suitable type. Categorization of firewall logs data is multi fold in proposed system. Major stages of proposed approach are described in the following section. Classification of the emails based on their conceptual similarity rather than blind term wise similarity along with firewall logs header, html content and attachment analysis.