Abstract: Linux security monitoring is built on system logs that capture events ranging from process executions to kernel failures to its authentication attempts. These records are bulky and redundant ...