Instantiating the Set-based Approach for Syslog-style Audit Data

In this Chapter the set-based approach from Part II is instantiated for ASCII format audit data in Unix systems as proposed in Sect. 17.2. Sect. 19.1 shows how the treatment of abstract events can be instantiated for ASCII format audit records. Sect. 19.2 presents how the pseudonymity-layer data for pseudonym disclosure is embedded in application-layer ASCII format audit records. The trust model in use is described in Sect. 19.3. In Sect. 19.4 we briefly introduce the components of the architecture we design for the implementation of the pseudonymizer embeddings identified in Sect. 18.3. Chapter 20 describes the toolset Pseudo/CoRe, which implements the set-based approach for ASCII format audit data. Except for the specializations made for the application for ASCII format audit data, the approach works as described in Part II.