Eliciting and utilising knowledge for security event log analysis: An association rule mining and automated planning approach

Abstract

Vulnerability assessment and security configuration activities are heavily reliant on expert knowledge. This requirement often results in many systems being left insecure due to a lack of analysis expertise and access to specialist resources. It has long been known that a system's event logs provide historical information depicting potential security breaches, as well as recording configuration activities. However, identifying and utilising knowledge within the event logs is challenging for the non-expert. In this paper, a novel technique is developed to process security event logs of a computer that has been assessed and configured by a security professional, extract key domain knowledge indicative of their expert decision making, and automatically apply learnt knowledge to previously unseen systems by non-experts.The technique converts event log entries into an object-based model and dynamically extracts associative rules. The rules are further improved in terms of quality using a temporal metric to autonomously establish temporal-association rules and acquire a domain model of expert configuration tasks. The acquired domain model and problem instance generated from a previously unseen system can then be used to produce a plan-of-action, which can be exploited by non-professionals to improve their system's security. Empirical analysis is subsequently performed on 20 event logs, where identified plan traces are discussed in terms of accuracy and performance.

TSARM-UDP: An Efficient Time Series Association Rules Mining Algorithm Based on Up-to-Date Patterns

“…In this section, we apply the TSARM-UDP algorithm to the public stock dataset to mine time-series association rules. Furthermore, a performance comparison is done of the TSARM-UDP algorithm with other temporal algorithms presented in [ 35 , 36 ] and FPgrowth [ 22 ]. The mining results are shown in Figure 4 and Figure 5 .…”

Temporal association rule mining: An overview considering the time variable as an integral or implied component

“…The sequence or episode rules have been successfully applied to a wide variety of applications. For instance, they have been used to quickly identify unused spectrum bands that allow opportunistic access by radios seeking spectrum, alleviating the problem of constantly increasing demand for communication bandwidth (Heydari & Tajer, 2019), to improve system security through the analysis of event logs with historical information of potential security breaches (Khan & Parkinson, 2018), to predict the traffic congestion level (Wen, Zhang, Sun, Wang, & Xu, 2019), and so on.…”

Temporal Association Rule Mining and Updating and Their Application to Blast Furnace in the Steel Industry

“…However, the algorithm can only discover the temporal pattern and not association rules. In [24], Khen and Simon proposed a novel method for discovering the temporal association rules; however, the performance of the algorithm is sensitive to a parameter, namely, the temporal-association accuracy (TAA). In [25], Wen et al…”

“…We selected 1438 data from an authentic blast furnace as sample data for time-series association rule mining. To evaluate the performance of the proposed algorithm, we will compare it with the performances of the state-of-the-art algorithms [23,24] and FP-Growth.…”

“…In Figure 4, we compare the L 1 , L 2 , L k , and the number of rules that are mined by the proposed algorithm with the corresponding state-of-the-art algorithms [23,24] and FP-Growth when min_conf is 0.6, min CF is 0.4, and T � 6. In this experiment, the values of min_sup ranged from 0.1 to 0.8.…”