Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security

异常检测 变量(数学) 计算机科学 事件(粒子物理) 数据挖掘 数据类型 离群值 假阳性悖论 数学 人工智能 数学分析 物理 量子力学 程序设计语言
作者
Markus Wurzenberger,Georg Höld,Max Landauer,Florian Skopik
出处
期刊:Computers & Security [Elsevier BV]
卷期号:137: 103631-103631 被引量:8
标识
DOI:10.1016/j.cose.2023.103631
摘要

Log lines consist of static parts that characterize their structure and enable assignment of event types, and event parameters, i.e., variable parts that provide specific information on system processes, such as host and user names, IP addresses, and file operations. Many detection approaches only focus on anomalous event type occurrences, i.e., they parse log lines to derive unique event identifiers and subsequently detect anomalies in event sequences or event count vectors, but neglect variable parts of log lines entirely during analysis. This is especially problematic, when monitoring strongly structured log data that contains only a small number of distinct event types, for example, logs that consist of strict key value pairs, i.e., parameters that occur consistently throughout all log lines, such as it is case in access and audit logs. Thus, novel approaches are required, which focus on analysis of log lines' variable parts. In this paper, we propose the variable type detector (VTD), a novel unsupervised approach that autonomously analyzes variable log line parts to enable anomaly detection. It assigns data types to each variable, which also include probability distributions for discrete and continuous variables. The VTD raises an alarm if a variable's data type changes. Furthermore, it implements a robust indicator function that reduces false positives by tracking the data type history of each variable and reports only significant data type changes. Additionally, an event indicator enables event-based anomaly detection by taking into account the data types of all variables of a single event type. The evaluation conducted on open-source log data, demonstrates the effectiveness of the VTD compared to conventional anomaly detection approaches, such as time series analysis and PCA. Consequently, the VTD acts as a solution that extends the intrusion detection capabilities of security information and event management (SIEM) and integrates with modern concepts of endpoint detection and response (EDR) and extended detection and responses (XDR), while simultaneously serving as an asset for process monitoring that supports user and entity behavior analytics (UEBA).
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
刚刚
2秒前
3秒前
4秒前
Polarlicht完成签到,获得积分10
5秒前
媛媛完成签到,获得积分10
5秒前
傲娇颖完成签到,获得积分10
7秒前
ShellyMaya完成签到 ,获得积分10
8秒前
9秒前
一只大憨憨猫完成签到,获得积分10
9秒前
JJ完成签到,获得积分10
9秒前
DrW完成签到,获得积分10
9秒前
隐形曼青应助yue采纳,获得10
10秒前
ccyy完成签到 ,获得积分10
10秒前
NexusExplorer应助腾腾腾采纳,获得10
11秒前
宿帅帅完成签到,获得积分10
12秒前
12秒前
Ningxin完成签到,获得积分10
12秒前
HHEHK发布了新的文献求助10
12秒前
柚子完成签到 ,获得积分10
12秒前
雨辰完成签到,获得积分10
14秒前
宿帅帅发布了新的文献求助10
14秒前
量子星尘发布了新的文献求助10
17秒前
17秒前
熠熠完成签到,获得积分10
17秒前
18秒前
zxzb完成签到,获得积分10
20秒前
苹果萧完成签到 ,获得积分10
23秒前
宋江他大表哥完成签到,获得积分10
23秒前
able发布了新的文献求助10
23秒前
王先生完成签到 ,获得积分10
24秒前
H.发布了新的文献求助10
24秒前
luoluo完成签到,获得积分10
25秒前
25秒前
高分子完成签到,获得积分10
25秒前
yian发布了新的文献求助10
26秒前
yar应助体贴凌柏采纳,获得10
27秒前
自由的雪一完成签到,获得积分10
27秒前
Ava应助李振博采纳,获得200
27秒前
JW发布了新的文献求助10
28秒前
高分求助中
【提示信息,请勿应助】关于scihub 10000
Les Mantodea de Guyane: Insecta, Polyneoptera [The Mantids of French Guiana] 3000
徐淮辽南地区新元古代叠层石及生物地层 3000
The Mother of All Tableaux: Order, Equivalence, and Geometry in the Large-scale Structure of Optimality Theory 3000
Handbook of Industrial Diamonds.Vol2 1100
Global Eyelash Assessment scale (GEA) 1000
Picture Books with Same-sex Parented Families: Unintentional Censorship 550
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 4038303
求助须知:如何正确求助?哪些是违规求助? 3576013
关于积分的说明 11374210
捐赠科研通 3305780
什么是DOI,文献DOI怎么找? 1819322
邀请新用户注册赠送积分活动 892672
科研通“疑难数据库(出版商)”最低求助积分说明 815029