Matrix Factorization Techniques for Recommender Systems

Identifying anomalies from log data for insider threat detection is practically a very challenging task for security analysts User behavior modeling is very important for the identification of these anomalies This paper presents unsupervised user behavior modeling for anomaly detection The proposed approach uses LSTM based Autoencoder to model user behavior based on session activities and thus identify the anomalous data points The proposed method follows a two-step process First, it calculates the reconstruction error using the autoencoder on the non-anomalous dataset, and then it is used to define the threshold to separate the outliers from the normal data points The identified outliers are then classified as anomalies The CERT insider threat dataset has been used for the research work For each user, the feature vectors are prepared by extracting key information from corresponding raw events and aggregating the data points based on users' actions within respective users' sessions LSTM Autoencoder has been implemented for behavior learning and anomaly detection For any unseen behavior or anomaly pattern, the model produces high reconstruction error which is an indication of an anomaly The experimental results show that in the best case, the model produced an Accuracy of 9017%, True Positives 9103%, and False Positives 984% Thus, the results suggest that the proposed approach can be effectively used in automatic anomaly detection

User Behavior Analytics for Anomaly Detection Using LSTM Autoencoder - Insider Threat Detection

Significant research has been carried out in the field of User Behavior Analysis, focused on understanding, modeling and predicting past, present and future behaviors of users. However, the heterogeneity of the approaches makes their comprehension very complicated. Thus, domain and Machine Learning experts have to work together to achieve their objectives. The main motivation for this work is to obtain an understanding of this field by providing a categorization of state-of-the-art works grouping them based on specific features. This paper presents a comprehensive survey of the existing literature in the areas of Cybersecurity, Networks, Safety and Health, and Service Delivery Improvement. The survey is organized based on four different topic-based features which categorize existing works: keywords, application domain, Machine Learning algorithm, and data type. This paper aims to thoroughly analyze the existing references, to promote the dissemination of state-of-the-art approaches discussing their strong and weak points, and to identify open challenges and prospective future research directions. In addition, 127 discussed papers have been scored and ranked according to relevance-based features: paper reputation, maximum author reputation, novelty, innovation and data quality. Both types of features, topic-based and relevance-based have been combined to build a similarity metric enabling a rich visualization of all considered publications. The obtained graphic representation provides a guide of recent advancements in User Behavior Analysis by topic, highlighting the most relevant ones.

A survey for user behavior analysis based on machine learning techniques: current models and applications

A survey on forensic investigation of operating system logs

This work aims to review the state-of-the-art deep learning architectures in Cyber Security applications by highlighting the contributions and challenges from various recent research papers.

/pdf/a-comprehensive-tutorial-and-survey-of-applications-of-deep-3d4ye7b0uc.pdf

A Comprehensive Tutorial and Survey of Applications of Deep Learning for Cyber Security

Security is one of the top concerns of any enterprise. Most security practitioners in enterprises rely on correlation rules to detect potential threats. While the rules are intuitive to design, each rule is independently defined per log source, unable to collectively address heterogeneity of data from a myriad of enterprise networking and security logs. Furthermore, correlation rules do not look for data events beyond a short time range. To complement the conventional correlation rules-based system, we propose a user activity anomaly detection method. The method first addresses data heterogeneity of multi-source logs by designing a meta data extraction step for event normalization. It then builds user-specific models to flag alerts for users whose currently observed event patterns are sufficiently different from their own patterns in the past.

Anomalous User Activity Detection in Enterprise Multi-source Logs

Unmanaged and unauthorized devices present in a corporate network pose potential security risk. Gaining insights into these devices starts with their identification. However, there have been few studies that recognize these devices among tens to hundreds of thousands of devices typically present on a large corporate network. On the other hand, names of the unmanaged and unauthorized devices are telling, as they do not necessarily conform to the existing known and unknown naming conventions followed by the majority of machines managed by a corporation. This work examines the lexical content of networked device names to flag devices with unusual names that are worth noting. We show how a long short-term memory (LSTM) network learns from the device names to flag the anomalously named devices. We demonstrate how the method offers a practical solution to detect unmanaged and unauthorized devices in real-world corporate networks.

Detecting unmanaged and unauthorized devices on the network with long short-term memory network

The present disclosure describes a system, method, and computer program for determining the cybersecurity risk associated with a first-time access event in a computer network. In response to receiving an alert that a user has accessed a network entity for the first time, a user behavior analytics system uses a factorization machine to determine the affinity between the accessing user and the accessed entity. The affinity measure is based on the accessing user's historical access patterns in the network, as wells as context data for both the accessing user and the accessed entity. The affinity score for an access event may be used to filter first-time access alerts or weight first-time access alerts in performing a risk assessment of the accessing user's network activity. The result is that many false-positive first-time access alerts are suppressed and not factored (or not factored heavily) into cybersecurity risk assessments.

Behavior analytics system for determining the cybersecurity risk associated with first-time, user-to-entity access alerts

Detecting security threats from compromised account or malicious insider by leveraging enterprise traffic logs is the goal of user behavior-based analytics. For its ease of interpretation, a common analytic indicator used in the industry for user behavior analytics is whether a user accesses a network entity, such as a machine or process, for the first time. While this popular indicator does correlate well with the threat activities, it has the potential of generating volumes of false positives. This creates a problem for an analytic system of which the first-time access alerting capability is a part. We believe that the false positive rate from the indicator can be reduced by learning from users' historical entity access patterns and user context information. If the first-time access is expected, then its corresponding alert is suppressed. In this paper, we propose a user-to-entity prediction score which uses a recommender system for learning user data. In particular, we use factorization machines, along with necessary data normalization steps, to make predictions on real-world enterprise logs. We demonstrate this novel method is capable of reducing false positives of users' first-time entity access alerts in user behavior analytics applications.

Reducing False Positives of User-to-Entity First-Access Alerts for User Behavior Analytics

Popular Tasks used by Researchers

How can I help with your research?

Get more enhanced response by uploading the PDFs you want me to reference.

No relevant PDFs in your library

SciSpace is the AI research assistant for academics. Run systematic literature reviews on 280M+ papers, and write papers with cited sources. Trusted by 1M+ students, PhDs & researchers.

SciSpace | AI for Research

We encountered an error while loading the panel. Please try refreshing the page.

Something went wrong

Analyze PDFs

Code & Manuscripts

Funding & Grants

Literature & Patents

Medical & Clinical Data

Systematic Review

Visualize & Present

Web & Data

Build a Google Scholar-like website for your research.

Build a website

Create charts and images for your research

Create a Chart

Write a paper for submission to a journal

Draft a manuscript

Patent Search

Design eye-catching scientific posters in minutes.

Scientific Poster Generation

Systematic Literature Review

Anyone with the link can view this chat. You can switch it back to private anytime.

One task is running at the moment. Your messages will be shown right after.

Drag and drop or click here to browse

Loved by <highlight>1 million+</highlight> researchers

Extract a list of specific topics and their sources from unstructured text

Topics

Compare and analyze relevant papers that matches with your search

Papers

Get insights from PDFs and bookmarked papers from your library

My library

Recent searches

Try searching for:

Catch AI-generated content in scholarly and non-scholarly content

{ai} Detector

Ai Writer

Get PDF Summaries, highlighted text explanations 

Chat with PDF

Effortlessly create in-text citations and bibliographies in APA and 2,500 other formats

Citation generator

Get explanations, summaries, and answers on academic papers

Ease up your research workflow with {scispace}'s cohort of exciting AI tools

Elevate your academic writing skills and convey your ideas the way you want

Paraphraser

Explore our range of reading and writing tools

Your file is being prepared and should be ready in a few minutes. If it's a large file, it might take a bit longer. You can close this window, and we'll email you the file when it's done.

You have reached a maximum limit of <strong>{limit}</strong> columns in the table. Remove at least <strong>1</strong> column to add or create another one.

Baoming Tang

Author Tools

Chat about Author

Papers

Anomalous User Activity Detection in Enterprise Multi-source Logs

Detecting unmanaged and unauthorized devices on the network with long short-term memory network

Behavior analytics system for determining the cybersecurity risk associated with first-time, user-to-entity access alerts

Reducing False Positives of User-to-Entity First-Access Alerts for User Behavior Analytics