Research is funded in part or whole by the National Science Foundation and the Office of Naval Research.

Other Log Anonymizers from the LAIM Group

CANINE: Converter and ANonymizer for Investigating Netflow Events

CANINE attempts to solve two problems that the current NetFlow tools often struggle with: (1) NetFlows come in many different, incompatible formats, and (2) the sensitivity of NetFlow logs can hinder the sharing of these logs and thus make it difficult for developers to get real data to use.

• As a converter, CANINE augments existing flow tools as it enables tools working exclusively with one type of NetFlows to operate on data from NetFlows in other formats.  This is very beneficial given the fact that different types of NetFlows can come from complementary sources as the format is often tied to the routing hardware or computer collecting the data. Currently, CANINE provides support for the following NetFlow formats:

  • Cisco NetFlow v5
  • Cisco NetFlow v7
  • NFDUMP
  • CiscoNCSA (fixed length binary format derived from Cisco flows)
  • ArgusNCSA (fixed length ASCII format derived from Argus-2.0.5 flows)

• As an anonymizer, CANINE addresses problems with sharing sensitive logs. People often have concerns about information disclosure when publishing results or performing demonstrations that utilize sensitive NetFlow logs. CANINE provides multiple methods of anonymizing the following fields:

  • IP address
  • Timestamp
  • Port Number
  • Protocol
  • Byte Count

Scrub-PA: Scrub-Process Accounting

SCRUB-PA is a tool that uses multi-level, multi-dimensional anonymization on process accounting log files in order to provide different levels of privacy protection. It is known that process accounting data is sensitive since it contains private user information, and thus security system administrators have been hindered from sharing these logs. Given that many interesting security applications could use process accounting data, it would be useful to have a tool that could protect private user information in the logs. For that purpose we have designed and developed SCRUB-PA. Our goal is to promote the sharing of process accounting logs while preserving privacy.