ACADEMIA

Researchers at the National Center for Supercomputing Applications (NCSA) have developed a log anonymization tool to help organizations better address the issue of computer and network security, which is of increasing concern as more and more critical information is stored and transferred digitally. Various computer and network logs provide information and opportunities to diagnose and prevent problems, and organizations could benefit from sharing their log information with one another. However, their reluctance to release such sensitive data often trumps their desire to collaborate. Anonymizing log information makes information-sharing more secure, but the anonymization process strips away some information that could be useful. So trade-offs must be made between anonymization and security on the one hand and information and utility on the other. NCSA's new tool, called FLAIM (Framework for Log Anonymization and Information Management), provides the flexibility to create multiple anonymization levels, allowing users to determine the level of anonymization that meets their specific needs. And while other tools for log anonymization typically can handle only a single type of log data, FLAIM's modular design allows it to easily extend to handle new log formats. The tool currently supports pcap traces, netfilter/iptable logs, and NetFlows. The first public release of FLAIM is available for download at its Web site. The FLAIM team will continue development and enhancement of the software, with plans to integrate it with NCSA's data mining framework, D2K, and to develop an automated Web-based tool to help users develop effective anonymization policies. Development of FLAIM is supported by a grant from the National Science Foundation's Cyber Trust program and by the Office of Naval Research through the National Center for Advanced Secure Systems Research (NCASSR). For more information, go to its Web site.