HTTP LOG files Labeling

[wangweifrequent () gmail com]

Hi All,

We are working on anomaly detection of HTTP attacks.

In fact, we have collected a large amount of HTTP logs (apache sever), but  we didn't use IDS to label the data during 
collection.

Does any one know how to label the HTTP logs?  for example: one http log line like :

burtul.xx.fr - - [10/May/2007:14:46:07 +0200] "GET /ariana/Images/Icones/sound.gif HTTP/1.0" 200 579 
http://www-sop.inria.fr/ariana/fr/xx "Mozilla/5.0 (X11; U; Linux i686; fr; rv:1.7.13) Gecko/20060417" 

Any suggestions are very appreciated.

Wei WANG

INRIA 
2008-05-20 

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------