Anomaly Based Unknown Intrusion Detection in Endpoint Environments

Abstract

According to a study by Cybersecurity Ventures, cybercrime is expected to cost $6 trillion annually by 2021. Most cybersecurity threats access internal networks through infected endpoints. Recently, various endpoint environments such as smartphones, tablets, and Internet of things (IoT) devices have been configured, and security issues caused by malware targeting them are intensifying. Event logs-based detection technology for endpoint security is detected using rules or patterns. Therefore, known attacks can respond, but unknown attacks can be difficult to respond to immediately. To solve this problem, in this paper, local outlier factor (LOF) and Autoencoder detect suspicious behavior that deviates from normal behavior. It also detects threats and shows the corresponding threats when suspicious events corresponding to the rules created through the attack profile are constantly occurring. Experimental results detected eight new suspicious processes that were not previously detected, and four malicious processes and one suspicious process were judged using Hybrid Analysis and VirusTotal. Based on the experiment results, it is expected that the use of operational policies such as allowlists in the proposed model will significantly improve performance by minimizing false positives.

Anomaly-Based Intrusion Detection Systems in IoT Using Deep Learning: A Systematic Literature Review

“…We found that the trend goes to AE techniques. The studies [18,[41][42][43][44]48] used AE techniques because of the ability of AE to take advantage of the linear and nonlinear dimensionality reduction to detect the anomalies. The AE training phase involves the reconstruction of clean input data from a partially destroyed one as well as the ability of AE to deal with heterogeneity, unstructured and high dimensional data that generated from IoT device.…”

“…In [39], by using a test-bed and CTU-13 datasets, the range of attacks included Infiltration attack, Propagation attack, worm infiltration, and worm propagation attack. In the study conducted by [43], the authors used the self-collection dataset and focused on interval attacks. In the studies [17,32,37,46,49], there was no report explaining what kinds of attacks they used.…”

E-SFD: Explainable Sensor Fault Detection in the ICS Anomaly Detection System

“…Haselmann et al [19] proposed image-based anomaly detection using Convolutional Neural Networks (CNN) for surface inspection used in the manufacturing industry. Kim et al [20] used an unsupervised AutoEncoder (AE) to detect unknown attacks in a single event. Some studies detect abnormal behavior of malicious code using principal component analysis, similar to AE [21].…”

“…Image, Sensor, Network Event, Other (data) CNN, AE, its variants [19], [20], [21], [22] Sequential Video, Speech, Protein Sequence, Time Series, Text (Natural language) CNN, RNN, LSTM, GRU [23], [24], [25], [26], [27] B. XAI RESEARCH XAI evolved to explain the black box model. Although there are a variety of XAI technologies, they are usually designed for images and rely on visual interpretability to evaluate and provide explanations.…”

Semi-supervised based Unknown Attack Detection in EDR Environment

“…The highest accuracy was obtained when 8 convolutional layers were arranged, but the CNN composed of 4 layers was also not much different from the CNN with 8 convolutional layers in accuracy, and progressed much faster in speed. Kim et al [17] detects anomalies in the event log using LOF and AutoEncoder among the anomaly detection techniques and suggests event rules generated through an attack profile. LOF was calculated based on the k-Nearest Neighbor (kNN) algorithm.…”