%!TEX encoding = IsoLatin
%!TEX main = honeypot_and_generative_ai.tex

System logs are critical in monitoring, diagnosing, and securing an operating system. In a typical Ubuntu environment, logs such as \textit{auth.log}, \textit{syslog}, and \textit{kern.log} provide valuable information about authentication events, system messages, and kernel activity. However, the manual analysis of these logs can be time-consuming and complex, requiring deep expertise to extract meaningful insights that can aid in security monitoring and system administration.

This case study explores the use of AI to automate the analysis of these critical system logs. The goal of passing the main logs of an Ubuntu system to a generative AI model is to enable the AI to extract valuable information that would assist a professional in identifying patterns, potential security risks, and critical system events. This approach aims to streamline the log analysis process, making it more efficient and accessible for IT administrators and cybersecurity professionals. Applications of this analysis include the detection of common security threats, such as brute force attacks, denial-of-service (DoS) attacks, and unauthorized access attempts. Additionally, by parsing through large volumes of system data, AI-based analysis can identify performance bottlenecks, system misconfigurations, or hardware failures. By automating these tasks, AI offers a powerful tool for reducing the manual effort required to maintain system security and operational health, providing timely insights that can enhance system performance and security defences.

\section{Analysis Workflow}

The system logs analysis processes each log file individually, following a structured approach to extract meaningful information. First, the log file is fetched from the \textit{/var/log} folder, focusing on logs like \textit{auth.log}, \textit{syslog}, and \textit{kern.log}. To manage large log files efficiently and avoid exceeding the AI's context processing limits, the most recent \textit{N} lines of the log are selected for analysis, where \textit{N} is a configurable parameter that can be adjusted before starting the process. Once the appropriate log lines are chosen, they are passed to the AI for analysis. Thanks to prompt engineering, the latter identifies and extracts vital patterns, events, and essential details from the log entries. For example, in the case of \textit{auth.log}, the AI might group login attempts by IP address, flagging any suspicious behaviour or security threats. The AI produces a schematic output, which focuses on relevant information without any unnecessary explanations or formatting.

After completing the analysis, the AI-generated output is saved in a \textit{.txt} file. This file contains the structured analysis, making it easy for analysts to review and understand critical aspects of the system logs. Each log is processed this way, ensuring that the relevant data from each file is extracted, stored, and ready for further review by system administrators or security experts. This process not only automates the traditionally manual task of log analysis but also ensures that the most important details are highlighted efficiently.