GraphBAD: A General Technique for Anomaly Detection in Security Information and Event Management
2018
The reliance on expert knowledge –required for analysing security logs and performing
security audits– has created an unhealthy balance where many computer
users are not able to correctly audit their security configurations and react to potential
security threats. The decreasing cost of IT and the increasing use of technology
in domestic life is exacerbating this problem where small companies and home IT
users are not able to afford the price of experts for auditing their systems configuration.
In this paper we present GraphBAD, a graph-based analysis tool able to analyse
security configurations in order to identify anomalies that could lead to potential
security risks. GraphBAD, which does not require any prior domain knowledge,
generates graph-based models from security configuration data and, by analysing
such models, is able to propose mitigation plans that can help computer users in
increasing the security of their systems. A large experimental analysis, conducted on
both publicly available (the well-known KDD dataset) and synthetically generated
testing sets (file system permissions), demonstrates the ability of GraphBAD in
correctly identifying security configurations anomalies and suggesting appropriate
mitigation plans.
Keywords:
- Correction
- Source
- Cite
- Save
- Machine Reading By IdeaReader
41
References
6
Citations
NaN
KQI