Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users

Abstract

Autoencoder-based anomaly detection methods have been used in identifying anomalous users from large-scale enterprise logs with the assumption that adversarial activities do not follow past habitual patterns. Most existing approaches typically build models by reconstructing single-day and individual-user behaviors. However, without capturing long-term signals and group-correlation signals, the models cannot identify low-signal yet long-lasting threats, and will wrongly report many normal users as anomalies on busy days, which, in turn, lead to high false positive rate. In this paper, we propose ACOBE, an Anomaly detection method based on COmpound BEhavior, which takes into consideration long-term patterns and group behaviors. ACOBE leverages a novel behavior representation and an ensemble of deep autoencoders and produces an ordered investigation list. Our evaluation shows that ACOBE outperforms prior work by a large margin in terms of precision and recall, and our case study demonstrates that ACOBE is applicable in practice for cyberattack detection.

Exploration of Enterprise Server Data to Assess Ease of Modeling System Behavior

“…Leveraging Logon Statistics: Several studies proposed anomaly detection methods to identify the change in a user's logon activity pattern [12,16,23,61]. Since users perform most of their activity on dedicated end-user systems, they perform fewer logons that last longer durations.…”

“…The logon behavior of users of end-user systems is successfully utilized to detect attacks that leverage compromised credentials or insider threats [12,18,40,41]. These approaches need to be further complemented with user logon patterns to servers.…”

“…An important focus of enterprise security has been on developing techniques that combine rule-and anomaly-based approaches to detect targeted attacks [1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16]. These approaches can be divided into two general groups.…”