Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security

异常检测 变量(数学) 计算机科学 事件(粒子物理) 数据挖掘 数据类型 离群值 假阳性悖论 数学 人工智能 数学分析 物理 量子力学 程序设计语言
作者
Markus Wurzenberger,Georg Höld,Max Landauer,Florian Skopik
出处
期刊:Computers & Security [Elsevier BV]
卷期号:137: 103631-103631 被引量:8
标识
DOI:10.1016/j.cose.2023.103631
摘要

Log lines consist of static parts that characterize their structure and enable assignment of event types, and event parameters, i.e., variable parts that provide specific information on system processes, such as host and user names, IP addresses, and file operations. Many detection approaches only focus on anomalous event type occurrences, i.e., they parse log lines to derive unique event identifiers and subsequently detect anomalies in event sequences or event count vectors, but neglect variable parts of log lines entirely during analysis. This is especially problematic, when monitoring strongly structured log data that contains only a small number of distinct event types, for example, logs that consist of strict key value pairs, i.e., parameters that occur consistently throughout all log lines, such as it is case in access and audit logs. Thus, novel approaches are required, which focus on analysis of log lines' variable parts. In this paper, we propose the variable type detector (VTD), a novel unsupervised approach that autonomously analyzes variable log line parts to enable anomaly detection. It assigns data types to each variable, which also include probability distributions for discrete and continuous variables. The VTD raises an alarm if a variable's data type changes. Furthermore, it implements a robust indicator function that reduces false positives by tracking the data type history of each variable and reports only significant data type changes. Additionally, an event indicator enables event-based anomaly detection by taking into account the data types of all variables of a single event type. The evaluation conducted on open-source log data, demonstrates the effectiveness of the VTD compared to conventional anomaly detection approaches, such as time series analysis and PCA. Consequently, the VTD acts as a solution that extends the intrusion detection capabilities of security information and event management (SIEM) and integrates with modern concepts of endpoint detection and response (EDR) and extended detection and responses (XDR), while simultaneously serving as an asset for process monitoring that supports user and entity behavior analytics (UEBA).
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
CipherSage应助ZWGS采纳,获得30
2秒前
3秒前
4秒前
张雷应助Quinna采纳,获得20
4秒前
5秒前
Cloud发布了新的文献求助10
5秒前
5秒前
传奇3应助小胖采纳,获得10
6秒前
陶醉延恶完成签到,获得积分20
8秒前
budingman发布了新的文献求助20
9秒前
Peng应助毛豆爸爸采纳,获得10
10秒前
letter发布了新的文献求助10
11秒前
zwy109发布了新的文献求助10
11秒前
11秒前
细辛发布了新的文献求助10
11秒前
12秒前
小刺猬发布了新的文献求助10
14秒前
17秒前
18秒前
小小应助文件撤销了驳回
18秒前
小胖完成签到,获得积分10
18秒前
李健应助22222采纳,获得10
18秒前
脑洞疼应助陶醉延恶采纳,获得10
19秒前
鳗鱼思真完成签到,获得积分20
19秒前
小胖发布了新的文献求助10
20秒前
20秒前
量子星尘发布了新的文献求助10
21秒前
jiang完成签到,获得积分10
23秒前
23秒前
26秒前
27秒前
27秒前
27秒前
鳗鱼思真发布了新的文献求助10
31秒前
王星星发布了新的文献求助10
31秒前
31秒前
英俊的铭应助俏皮的白柏采纳,获得10
32秒前
Owen应助方格采纳,获得10
32秒前
33秒前
啤酒人完成签到 ,获得积分10
33秒前
高分求助中
A new approach to the extrapolation of accelerated life test data 1000
ACSM’s Guidelines for Exercise Testing and Prescription, 12th edition 500
‘Unruly’ Children: Historical Fieldnotes and Learning Morality in a Taiwan Village (New Departures in Anthropology) 400
Indomethacinのヒトにおける経皮吸収 400
Phylogenetic study of the order Polydesmida (Myriapoda: Diplopoda) 370
基于可调谐半导体激光吸收光谱技术泄漏气体检测系统的研究 350
Robot-supported joining of reinforcement textiles with one-sided sewing heads 320
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 3988997
求助须知:如何正确求助?哪些是违规求助? 3531351
关于积分的说明 11253520
捐赠科研通 3269928
什么是DOI,文献DOI怎么找? 1804830
邀请新用户注册赠送积分活动 882063
科研通“疑难数据库(出版商)”最低求助积分说明 809068