论文标题
时间窗口群体相关支持与个人功能：异常用户的检测
Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users
论文作者
论文摘要
基于自动编码器的异常检测方法已用于识别大型企业日志的异常用户，并假设对抗性活动不遵循过去的习惯模式。大多数现有方法通常通过重建单日和个人用户行为来构建模型。但是，如果不捕获长期信号和群体相关信号，这些模型无法识别低信号但长期持久的威胁，并且会错误地将许多普通用户报告为繁忙的日子异常，从而导致高误报率。在本文中，我们提出了Acobe，Acobe是一种基于复合行为的异常检测方法，该方法考虑了长期模式和群体行为。 Acobe利用了一种新颖的行为表示和深层自动编码器的合奏，并产生有序的调查列表。我们的评估表明，在精确和召回方面，Acobe的表现要优于先前的工作，而我们的案例研究表明，Acobe适用于实际的网络攻击检测。
Autoencoder-based anomaly detection methods have been used in identifying anomalous users from large-scale enterprise logs with the assumption that adversarial activities do not follow past habitual patterns. Most existing approaches typically build models by reconstructing single-day and individual-user behaviors. However, without capturing long-term signals and group-correlation signals, the models cannot identify low-signal yet long-lasting threats, and will wrongly report many normal users as anomalies on busy days, which, in turn, lead to high false positive rate. In this paper, we propose ACOBE, an Anomaly detection method based on COmpound BEhavior, which takes into consideration long-term patterns and group behaviors. ACOBE leverages a novel behavior representation and an ensemble of deep autoencoders and produces an ordered investigation list. Our evaluation shows that ACOBE outperforms prior work by a large margin in terms of precision and recall, and our case study demonstrates that ACOBE is applicable in practice for cyberattack detection.
