I’m a Comp Sc student majoring in networking..currently working on my final year project regarding IDS using alert fusion. My basic idea is i want to make a program that can read/scan an IDS log file then it will divide those alert into the same category(attack signature). Then my program will scan keywords which is IP address (source+destination) and port no(source+destination)to categorize the alert whether it is a true attack or its just a false positive alert. My question are:
1. How can i build a software that can read a IDS’s log file to filter those alert?
2. Is it to possible for log file to be saved in .txt format? because i think i want to build a software using JAVA so it might be much easier doing so rather than connecting my program to mySQL.