A Fine-grained Approach for Anomaly Detection in File System Accesses with Enhanced Temporal User Profiles

Mehnaz, Shagufta; Bertino, Elisa

doi:10.1109/tdsc.2019.2954507

Cited by 8 publications

(6 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other aspects of user behavior have been modeled for anomaly detection: [83] model user actions related to file and information access, with the expectation that adversaries (making use of compromised accounts) won't be as directed and efficient in this task. Other characteristics of file system access, like timestamps and file size, were analyzed in [84]. GUI interactions, including keyboard activity and mouse movements were modeled via SVM in [85] and random forest applied to Microsoft Word interactions in [86].…”

Section: Host-based Indicatorsmentioning

confidence: 99%

Role-based lateral movement detection with unsupervised learning

Powell¹

2021

Preprint

View full text Add to dashboard Cite

Adversarial lateral movement via compromised accounts remains difficult to discover via traditional rule-based defenses because it generally lacks explicit indicators of compromise. We propose a behavior-based, unsupervised framework comprising two methods of lateral movement detection on enterprise networks: one aimed at generic lateral movement via either exploit or authenticated connections, and one targeting the specific techniques of process injection and hijacking. The first method is based on the premise that the role of a system-the functions it performs on the network-determines the roles of the systems it should make connections with. The adversary meanwhile might move between any systems whatever, possibly seeking out systems with unusual roles that facilitate certain accesses. We use unsupervised learning to cluster systems according to role and identify connections to systems with novel roles as potentially malicious. The second method is based on the premise that the temporal patterns of inter-system processes that facilitate these connections depend on the roles of the systems involved. If a process is compromised by an attacker, these normal patterns might be disrupted in discernible ways. We apply frequent-itemset mining to process sequences to establish regular patterns of communication between systems based on role, and identify rare process sequences as signalling potentially malicious connections.

show abstract

Section: Host-based Indicatorsmentioning

confidence: 99%

Role-based lateral movement detection with unsupervised learning

Powell¹

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Learning-based Detections. There are many learning-based security solutions (e.g., [38,39,[51][52][53][54][55]), which offer anomaly detection. Unlike above-mentioned works, this paper proposes a totally different learning-based technique to facilitate the proactive auditing.…”

Section: Related Workmentioning

confidence: 99%

Learning probabilistic dependencies among events for proactive security auditing in clouds

Majumdar

Tabiban

Jarraya

et al. 2019

JCS

View full text Add to dashboard Cite

Security compliance auditing is a viable solution to ensure the accountability and transparency of a cloud provider to its tenants. However, the sheer size of a cloud, coupled with the high operational complexity implied by the multi-tenancy and self-service nature, can easily render existing runtime auditing techniques too expensive and non-scalable. To this end, a proactive approach, which prepares for the auditing ahead of critical events, is a promising solution to reduce the response time to a practical level. However, a key limitation of such approaches is their reliance on manual efforts to extract the dependency relationships among events, which greatly restricts their practicality. What makes things worse is the fact that, as the most important input to security auditing, the logs and configuration databases of a real world cloud platform can be unstructured and not ready to be used for efficient security auditing. In this paper, we first propose a log processing technique, which prepares raw cloud logs for different analysis purposes, and then design a learning-based proactive security auditing system, namely, LeaPS + . To this end, we conduct case studies on current log formats in different real-world OpenStack (a popular cloud platform) deployments, and identify major challenges in log processing. Later, we design a stand-alone log processor for clouds, which may potentially be used for various log analyses. Consequently, we leverage the log processor outputs to extract probabilistic dependencies from runtime events for the dependency models. Finally, through these dependency models, we proactively prepare for security critical events and prevent security violations resulting from those critical events. Furthermore, we integrate LeaPS + to OpenStack and perform extensive experiments in both simulated and real cloud environments that show a practical response time (e.g., 6ms to audit a cloud of 100,000 VMs) and a significant improvement (e.g., about 50% faster) over existing proactive approaches. In addition, we successfully and efficiently apply our log processor outputs to other learning techniques (e.g., executing sequence pattern mining algorithms within 18ms for 50,000 events).

show abstract

“…Learning-Based Detections. There are many learning-based security solutions (e.g., [104,43,45,55,78,46,75]), which offer anomaly detection. Unlike above-mentioned solutions, this work proposes a totally different learning-based technique to facilitate the proactive auditing.…”

Section: Related Workmentioning

confidence: 99%

Proactive Security Auditing in Clouds

Majumdar

Madi²,

Wang³

et al. 2019

Cloud Security Auditing

View full text Add to dashboard Cite

Cloud computing is emerging as a promising IT solution for enabling ubiquitous, convenient, and on-demand accesses to a shared pool of configurable computing resources. However, the widespread adoption of cloud is still being hindered by the lack of transparency and accountability, which has traditionally been ensured through security auditing techniques. Security auditing in the cloud poses many unique challenges in data collection and processing (e.g., data format inconsistency and lack of correlation due to the heterogeneity of cloud infrastructures), and in verification (e.g., prohibitive performance overhead due to the sheer scale of cloud infrastructures and need of runtime verification for the dynamic nature of cloud). To this extent, existing security auditing solutions can mainly be categorized into three types: retroactive, intercept-and-check and proactive. The retroactive auditing approach is the traditional auditing technique, which audits after the fact and cannot prevent irreversible damages (e.g., leakage of sensitive information and denial of service attacks). The intercept-and-check approach offers runtime auditing and performs all the auditing steps after the occurrence of a critical event (i.e., which may potentially violate a security property). However, this approach results significant delay in responding each critical event. On the other hand, the existing proactive approach requires the changes (in the cloud configurations) planned for the future in advance to verify its compliance; however, this approach is not practical, because the future change plan is not always available due to cloud's dynamic and ad-hoc nature. In this thesis, we address all the above-mentioned limitations of the existing works by proposing a proactive security auditing system, which potentially can prevent irreversible damages, respond in significantly less time and offer a practical approach without requiring any future change plan. To this purpose, we conduct our work into three main phases. During the first phase, we propose a runtime security auditing system for the user-level of the cloud; where our proposed system audits wide range of security properties relevant to different authentication and authorization mechanisms, such as role-based access control (RBAC), attribute-based access control (ABAC) and single sign-on (SSO), and enhances the existing intercept-and-check solutions by adopting an incremental approach to improve the efficiency. In the second phase of our work, we propose a novel approach of proactive security auditing; which leverages the dependency relationship among cloud events and pre-computes the most expensive parts of the auditing process to keep the response time This thesis work is the outcome of collaboration and support of many people, to whom I am sincerely grateful and would like to appreciate their help.At the very beginning, I would like to thank my PhD supervisor Dr. Lingyu Wang. His continuous availability and guidance helped me the most to complete this thesis work. I am gratef...

show abstract

A Fine-grained Approach for Anomaly Detection in File System Accesses with Enhanced Temporal User Profiles

Cited by 8 publications

References 49 publications

Role-based lateral movement detection with unsupervised learning

Role-based lateral movement detection with unsupervised learning

Learning probabilistic dependencies among events for proactive security auditing in clouds

Proactive Security Auditing in Clouds

Contact Info

Product

Resources

About