Simulating User Activity for Assessing Effect of Sampling on DB Activity Monitoring Anomaly Detection

Grushka-Cohen, Hagit; Biller, Ofer; Sofer, Oded; Rokach, Lior; Shapira, Bracha

doi:10.1007/978-3-030-17277-0_5

Cited by 3 publications

(12 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We compare three algorithms for the problem. The first two baseline algorithms were proposed in [8]. In addition we introduce a novel algorithm named C--Greedy based on -greedy algorithm for the Budget-Constrained-Dynamic-MAB problem.…”

Section: Sampling Algorithmsmentioning

confidence: 99%

“…In the Gibbs-exploration strategy, suggested by [8], the user probability to be sampled is proportional to the risk estimate.…”

Section: Gibbs-by-riskmentioning

confidence: 99%

“…4). [8] introduced a simulation package made of low complexity data, where the user activity for a timeframe is represented by a single aggregated risk score. Using simulated data also helps us avoid the bias introduced to the dataset during the collecting stage and allows us to introduce anomalies in a controlled fashion.…”

Section: Simulating Dam Monitoring Datamentioning

confidence: 99%

“…-Evaluation. Using simulated data-sets created with [8], we assess the effect of diversity on sampling policies. We introduce two evaluation measures: (i) coverage of user activity, i.e., how much do we know about each user in the population, and (ii) downstream effectiveness in identifying anomalies.…”

Section: Introductionmentioning

confidence: 99%

“…We introduce two evaluation measures: (i) coverage of user activity, i.e., how much do we know about each user in the population, and (ii) downstream effectiveness in identifying anomalies. Using these measures, we compare a number of strong baselines and show that the proposed algorithm outperforms oracle-knowledge policy sampling and the Gibbs-prior sampling approach suggested in [8].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Using Bandits for Effective Database Activity Monitoring

Grushka-Cohen

Biller²,

Sofer³

et al. 2020

Advances in Knowledge Discovery and Data Mining

Self Cite

View full text Add to dashboard Cite

Database activity monitoring systems aim to protect organizational data by logging users' activity to Identify and document malicious activity. High-velocity streams and operating costs, restrict these systems to examining only a sample of the activity. Current solutions use manual policies to decide which transactions to monitor. This limits the diversity of the data collected, creating a "filter bubble" over representing specific subsets of the data such as high-risk users and underrepresenting the rest of the population which may never be sampled. In recommendation systems, Bandit algorithms have recently been used to address this problem. We propose addressing the sampling for database activity monitoring problem as a recommender system. In this work, we redefine the data sampling problem as a special case of the multi-armed bandit problem and present a novel algorithm, C--Greedy, which combines expert knowledge with random exploration. We analyze the effect of diversity on coverage and downstream event detection using simulated data. In doing so, we find that adding diversity to the sampling using the bandit-based approach works well for this task, maximizing population coverage without decreasing the quality in terms of issuing alerts about events, and outperforming policies manually crafted by experts and other sampling methods.

show abstract

Section: Sampling Algorithmsmentioning

confidence: 99%

“…In the Gibbs-exploration strategy, suggested by [8], the user probability to be sampled is proportional to the risk estimate.…”

Section: Gibbs-by-riskmentioning

confidence: 99%

Section: Simulating Dam Monitoring Datamentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Using Bandits for Effective Database Activity Monitoring

Grushka-Cohen

Biller²,

Sofer³

et al. 2020

Advances in Knowledge Discovery and Data Mining

Self Cite

View full text Add to dashboard Cite

show abstract

Deep Learning-Based Network Security Data Sampling and Anomaly Prediction in Future Network

Liu

Lin

Wang

et al. 2020

Discrete Dynamics in Nature and Society

View full text Add to dashboard Cite

Based on the design idea of future network, this paper analyzes the network security data sampling and anomaly prediction in future network. Through game theory, it is determined that data sampling is performed on some important nodes in the future network. Deep learning methods are used on the selected nodes to collect data and analyze the characteristics of the network data. Then, through offline and real-time analyses, network security abnormal events are predicted in the future network. With the comparison of various algorithms and the adjustment of hyperparameters, the data characteristics and classification algorithms corresponding to different network security attacks are found. We have carried out experiments on the public dataset, and the experiment proves the effectiveness of the method. It can provide reference for the management strategy of the switch node or the host node by the future network controller.

show abstract

Diversifying Database Activity Monitoring with Bandits

Grushka-Cohen,

Biller,

Sofer

et al. 2019

Preprint

Self Cite

View full text Add to dashboard Cite

Database activity monitoring (DAM) systems are commonly used by organizations to protect the organizational data, knowledge and intellectual properties. In order to protect organizations database DAM systems have two main roles, monitoring (documenting activity) and alerting to anomalous activity. Due to high-velocity streams and operating costs, such systems are restricted to examining only a sample of the activity. Current solutions use policies, manually crafted by experts, to decide which transactions to monitor and log. This limits the diversity of the data collected. Bandit algorithms, which use reward functions as the basis for optimization while adding diversity to the recommended set, have gained increased attention in recommendation systems for improving diversity. In this work, we redefine the data sampling problem as a special case of the multi-armed bandit (MAB) problem and present a novel algorithm, which combines expert knowledge with random exploration. We analyze the effect of diversity on coverage and downstream event detection tasks using a simulated dataset. In doing so, we find that adding diversity to the sampling using the bandit-based approach works well for this task and maximizing population coverage without decreasing the quality in terms of issuing alerts about events.

show abstract

Simulating User Activity for Assessing Effect of Sampling on DB Activity Monitoring Anomaly Detection

Cited by 3 publications

References 8 publications

Using Bandits for Effective Database Activity Monitoring

Using Bandits for Effective Database Activity Monitoring

Deep Learning-Based Network Security Data Sampling and Anomaly Prediction in Future Network

Diversifying Database Activity Monitoring with Bandits

Contact Info

Product

Resources

About