Iterative Selection of Categorical Variables for Log Data Anomaly Detection

Landauer, Max; Höld, Georg; Wurzenberger, Markus; Skopik, Florian; Rauber, Andreas

doi:10.1007/978-3-030-88418-5_36

“…System performance metrics and numeric features of network traffic are suitable for statistical analyses such as testing for certain distributions. Alternatively, hypothesis testing is also applicable for detecting changes of correlating behavior of categorical variables in log data [39].…”

Section: Evaluation Of Intrusion Detection Systemsmentioning

confidence: 99%

Maintainable Log Datasets for Evaluation of Intrusion Detection Systems

Landauer¹,

Skopik²,

Frank³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Intrusion detection systems (IDS) monitor system logs and network traffic to recognize malicious activities in computer networks. Evaluating and comparing IDSs with respect to their detection accuracies is thereby essential for their selection in specific use-cases. Despite a great need, hardly any labeled intrusion detection datasets are publicly available. As a consequence, evaluations are often carried out on datasets from real infrastructures, where analysts cannot control system parameters or generate a reliable ground truth, or private datasets that prevent reproducibility of results. As a solution, we present a collection of maintainable log datasets collected in a testbed representing a small enterprise. Thereby, we employ extensive state machines to simulate normal user behavior and inject a multi-step attack. For scalable testbed deployment, we use concepts from model-driven engineering that enable automatic generation and labeling of an arbitrary number of datasets that comprise repetitions of attack executions with variations of parameters. In total, we provide 8 datasets containing 20 distinct types of log files, of which we label 8 files for 10 unique attack steps. We publish the labeled log datasets and code for testbed setup and simulation online as open-source to enable others to reproduce and extend our results.

show abstract

“…System performance metrics and numeric features of network traffic are suitable for statistical analyses such as time-series analysis and testing for certain distributions. Alternatively, hypothesis testing is also applicable for detecting changes of correlating behavior of categorical variables in log data [42].…”

mentioning

confidence: 99%

Maintainable Log Datasets for Evaluation of Intrusion Detection Systems

Landauer

¹

,

Skopik

²

,

Frank

³

et al. 2023

IEEE Trans. Dependable and Secure Comput.

Self Cite

View full text Add to dashboard Cite

Intrusion detection systems (IDS) monitor system logs and network traffic to recognize malicious activities in computer networks. Evaluating and comparing IDSs with respect to their detection accuracies is thereby essential for their selection in specific use-cases. Despite a great need, hardly any labeled intrusion detection datasets are publicly available. As a consequence, evaluations are often carried out on datasets from real infrastructures, where analysts cannot control system parameters or generate a reliable ground truth, or private datasets that prevent reproducibility of results. As a solution, we present a collection of maintainable log datasets collected in a testbed representing a small enterprise. Thereby, we employ extensive state machines to simulate normal user behavior and inject a multi-step attack. For scalable testbed deployment, we use concepts from model-driven engineering that enable automatic generation and labeling of an arbitrary number of datasets that comprise repetitions of attack executions with variations of parameters. In total, we provide 8 datasets containing 20 distinct types of log files, of which we label 8 files for 10 unique attack steps. We publish the labeled log datasets and code for testbed setup and simulation online as open-source to enable others to reproduce and extend our results.

show abstract