Log-based intrusion detection system