Analysis of statistical properties of variables in log data for advanced anomaly detection in cyber security

异常检测 变量(数学) 计算机科学 事件(粒子物理) 数据挖掘 数据类型 离群值 假阳性悖论 数学 人工智能 数学分析 物理 量子力学 程序设计语言
作者
Markus Wurzenberger,Georg Höld,Max Landauer,Florian Skopik
出处
期刊:Computers & Security [Elsevier BV]
卷期号:137: 103631-103631 被引量:8
标识
DOI:10.1016/j.cose.2023.103631
摘要

Log lines consist of static parts that characterize their structure and enable assignment of event types, and event parameters, i.e., variable parts that provide specific information on system processes, such as host and user names, IP addresses, and file operations. Many detection approaches only focus on anomalous event type occurrences, i.e., they parse log lines to derive unique event identifiers and subsequently detect anomalies in event sequences or event count vectors, but neglect variable parts of log lines entirely during analysis. This is especially problematic, when monitoring strongly structured log data that contains only a small number of distinct event types, for example, logs that consist of strict key value pairs, i.e., parameters that occur consistently throughout all log lines, such as it is case in access and audit logs. Thus, novel approaches are required, which focus on analysis of log lines' variable parts. In this paper, we propose the variable type detector (VTD), a novel unsupervised approach that autonomously analyzes variable log line parts to enable anomaly detection. It assigns data types to each variable, which also include probability distributions for discrete and continuous variables. The VTD raises an alarm if a variable's data type changes. Furthermore, it implements a robust indicator function that reduces false positives by tracking the data type history of each variable and reports only significant data type changes. Additionally, an event indicator enables event-based anomaly detection by taking into account the data types of all variables of a single event type. The evaluation conducted on open-source log data, demonstrates the effectiveness of the VTD compared to conventional anomaly detection approaches, such as time series analysis and PCA. Consequently, the VTD acts as a solution that extends the intrusion detection capabilities of security information and event management (SIEM) and integrates with modern concepts of endpoint detection and response (EDR) and extended detection and responses (XDR), while simultaneously serving as an asset for process monitoring that supports user and entity behavior analytics (UEBA).
最长约 10秒,即可获得该文献文件

科研通智能强力驱动
Strongly Powered by AbleSci AI
更新
PDF的下载单位、IP信息已删除 (2025-6-4)

科研通是完全免费的文献互助平台,具备全网最快的应助速度,最高的求助完成率。 对每一个文献求助,科研通都将尽心尽力,给求助人一个满意的交代。
实时播报
CodeCraft应助LuoYixiang采纳,获得10
3秒前
传奇3应助Vicky采纳,获得10
4秒前
6秒前
儒雅致远发布了新的文献求助10
7秒前
不喜发布了新的文献求助10
9秒前
10秒前
孙燕应助七曜采纳,获得10
11秒前
脑洞疼应助草上飞采纳,获得10
12秒前
12秒前
寻梦完成签到,获得积分10
13秒前
Vicky完成签到,获得积分10
15秒前
谷得猫宁完成签到,获得积分20
15秒前
orixero应助儒雅致远采纳,获得10
18秒前
Vicky发布了新的文献求助10
18秒前
1351567822应助传统的迎南采纳,获得10
19秒前
充电宝应助一颗椰子糖耶采纳,获得10
19秒前
丘比特应助ultramix采纳,获得10
20秒前
20秒前
Rondab应助糊涂的雪珊采纳,获得30
21秒前
潜水读者完成签到,获得积分10
22秒前
diu完成签到,获得积分20
22秒前
25秒前
26秒前
26秒前
27秒前
MQL完成签到,获得积分10
27秒前
小垃圾发布了新的文献求助10
27秒前
28秒前
莫遥完成签到 ,获得积分10
28秒前
zkwgly完成签到,获得积分10
28秒前
鱼蛋关注了科研通微信公众号
30秒前
30秒前
Ran发布了新的文献求助10
31秒前
如意枫叶发布了新的文献求助10
31秒前
zkwgly发布了新的文献求助10
31秒前
张雯思发布了新的文献求助10
31秒前
小蛮样完成签到,获得积分10
32秒前
tg2024完成签到,获得积分10
32秒前
33秒前
33秒前
高分求助中
A new approach to the extrapolation of accelerated life test data 1000
ACSM’s Guidelines for Exercise Testing and Prescription, 12th edition 500
‘Unruly’ Children: Historical Fieldnotes and Learning Morality in a Taiwan Village (New Departures in Anthropology) 400
Indomethacinのヒトにおける経皮吸収 400
Phylogenetic study of the order Polydesmida (Myriapoda: Diplopoda) 370
基于可调谐半导体激光吸收光谱技术泄漏气体检测系统的研究 350
Robot-supported joining of reinforcement textiles with one-sided sewing heads 320
热门求助领域 (近24小时)
化学 材料科学 医学 生物 工程类 有机化学 生物化学 物理 内科学 纳米技术 计算机科学 化学工程 复合材料 遗传学 基因 物理化学 催化作用 冶金 细胞生物学 免疫学
热门帖子
关注 科研通微信公众号,转发送积分 3989711
求助须知:如何正确求助?哪些是违规求助? 3531864
关于积分的说明 11255235
捐赠科研通 3270505
什么是DOI,文献DOI怎么找? 1804983
邀请新用户注册赠送积分活动 882157
科研通“疑难数据库(出版商)”最低求助积分说明 809176