Multi-Dimensional Anomalous Entity Detection via Poisson Tensor Factorization

Abstract

As the attack surfaces of large enterprise networks grow, anomaly detection systems based on statistical user behavior analysis play a crucial role in identifying malicious activities. Previous work has shown that link prediction algorithms based on non-negative matrix factorization learn highly accurate predictive models of user actions. However, most statistical link prediction models have been constructed on bipartite graphs, and fail to capture the nuanced, multi-faceted details of a user's activity profile. This paper establishes a new benchmark for red team event detection on the Los Alamos National Laboratory Unified Host and Network Dataset by applying a tensor factorization model that exploits the multi-dimensional and sparse structure of user authentication logs. We show that learning patterns of normal activity across multiple dimensions in one unified statistical framework yields improved detection of penetration testing events. We further show operational value by developing fusion methods that can identify anomalous users, source devices, and destination devices in the network.

User Behavior Analysis for Detecting Compromised User Accounts: A Review Paper

“…Comparison can be seen in Figs 3 and 4. LANL dataset is referenced by two papers [22,78]. There is one paper each referencing the SEA dataset [20], KDD dataset [21], and Azure Public dataset [23].…”

A source separation approach to temporal graph modelling for computer networks

“…One important characteristic of computer network monitoring is that it produces rich and complex data. While we focus on communications between hosts and their temporal component, one important avenue of research deals with jointly modelling the many other facets of these communications, such as the associated user accounts or network protocols [5]. Note, however, that the core of our approach could easily be extended in this direction: typically, instead of predicting temporal edges (i, j, t), we could predict hyperedges (v 1 , .…”

“…Tensor factorization and beyond. Besides dynamic latent space models, another popular approach to temporal graph modelling relies on Candecomp/Parafac (CP) tensor factorization [3,4,13], which Eren et al [5] proposed to use for computer network monitoring. The idea behind this approach is to represent a temporal graph as a three-mode tensor, with modes representing the time step, the origin and the destination, respectively.…”

“…We evaluate SNMF against several baselines. First, two dynamic models are included: Poisson tensor factorization (PTF [5]) and the bilinear mixed-effects model proposed by Lee et al (BME [23]). These two methods represent the two main approaches to dynamic latent space modelling identified in Section 2.2: adjusting all node embeddings using global time-dependent parameters, or allowing each node embedding to evolve on its own.…”