I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems regarding setting rules for the Log Processing. So anybody with any suggestion about How to set the rules?
As per my answer on your other post - have a look at the anomaly detection stuff over on the Snort forums. There are many aspects you will need to consider so try building on the work they have already done.
You will need to understand 'good traffic' for your network during the 'initial tuning' phase, use whitelists and blacklists of signatures, and then build heuristic analysis if you want to alert on deviation from the norm.
This is very resource-intensive, and complex to maintain, which is why many companies now outsource this entire piece to the big managed service providers.