Identify potential patterns of compromise on log files

An information handling system comprising:

• one or more processors;
• a memory coupled to at least one of the processors;
• and
• a set of instructions stored in the memory and executed by at least one of the processors to perform actions comprising:
• identifying a plurality of first obfuscation patterns, wherein the first obfuscation patterns correspond to tampering of a plurality of entries in a first set of one or more system log files;
• wherein the identifying the plurality of first obfuscation patterns comprises:
• selecting a plurality of dirty system log files and applying a term frequency-inverse document frequency algorithm to the plurality of dirty system log files resulting in first resultant values stored in a first data store, wherein the dirty system log files have been obfuscated with tampering to a plurality of entries in the dirty system log files;
• selecting a plurality of clean system log files and applying a term frequency-inverse document frequency algorithm to the plurality of clean system log files resulting in second resultant values stored in a second data store, wherein the clean system log files are untampered;
• and
• comparing the first resultant values of the dirty log files to the second resultant values of the clean log files, the result of the comparing being the plurality of first obfuscation patterns;
• monitoring a second set of one or more system log files, wherein the monitoring examines the second set of system log files for any one of the first obfuscation patterns;
• detecting, based on the monitoring, a system intrusion when one of the first obfuscation patterns matches a second obfuscation pattern found in one of the second set of system log files;
• and
• in response to detecting the system intrusion, performing an action comprising at least one of sending a notification or shutting down a system;
• wherein at least one of the system log files is selected from a group consisting of an event log, a server log, a system log, an authorization and access log, a change log, an availability log, a resource log, or a threat log.

A computer program product comprising:

• a computer readable storage medium comprising a set of computer instructions that, when executed by a processor, are effective to perform actions comprising:
• identifying a plurality of first obfuscation patterns, wherein the first obfuscation patterns correspond to tampering of a plurality of entries in a first set of one or more system log files;
• wherein the identifying the plurality of first obfuscation patterns comprises:
• selecting a plurality of dirty system log files and applying a term frequency-inverse document frequency algorithm to the plurality of dirty system log files resulting in first resultant values stored in a first data store, wherein the dirty system log files have been obfuscated with tampering to a plurality of entries in the dirty system log files;
• selecting a plurality of clean system log files and applying a term frequency-inverse document frequency algorithm to the plurality of clean system log files resulting in second resultant values stored in a second data store, wherein the clean system log files are untampered;
• and
• comparing the first resultant values of the dirty log files to the second resultant values of the clean log files, the result of the comparing being the plurality of first obfuscation patterns;
• monitoring a second set of one or more system log files, wherein the monitoring examines the second set of system log files for any one of the first obfuscation patterns;
• and
• detecting, based on the monitoring, a system intrusion when one of the first obfuscation patterns matches a second obfuscation pattern found in one of the second set of system log files;
• and
• in response to detecting the system intrusion, performing an action comprising at least one of sending a notification or shutting down a system;
• wherein at least one of the system log files is selected from a group consisting of an event log, a server log, a system log, an authorization and access log, a change log, an availability log, a resource log, or a threat log.