WATSON: Abstracting Behaviors from Audit Logs via Aggregation of Contextual Semantics

Abstract

Endpoint monitoring solutions are widely deployed in today's enterprise environments to support advanced attack detection and investigation. These monitors continuously record system-level activities as audit logs and provide deep visibility into security incidents. Unfortunately, to recognize behaviors of interest and detect potential threats, cyber analysts face a semantic gap between low-level audit events and high-level system behaviors. To bridge this gap, existing work largely matches streams of audit logs against a knowledge base of rules that describe behaviors. However, specifying such rules heavily relies on expert knowledge. In this paper, we present WATSON, an automated approach to abstracting behaviors by inferring and aggregating the semantics of audit events. WATSON uncovers the semantics of events through their usage context in audit logs. By extracting behaviors as connected system operations, WATSON then combines event semantics as the representation of behaviors. To reduce analysis workload, WATSON further clusters semantically similar behaviors and distinguishes the representatives for analyst investigation. In our evaluation against both benign and malicious behaviors, WATSON exhibits high accuracy for behavior abstraction. Moreover, WATSON can reduce analysis workload by two orders of magnitude for attack investigation.

RootLogChain: Registering Log-Events in a Blockchain for Audit Issues from the Creation of the Root

“…Audit logs are themselves a key target for an attacker who needs to erase any trace of their malicious activities; otherwise, they may get caught and then possibly prosecuted. The need for securing audit logging was raised already in different contexts, including hardware [3]; systems [4,5]; file systems [6]; databases [7]; secure logging protocols [8]; distributed systems [2,[10][11][12][13][14]; blockchain [1,[16][17][18][19][20]; and blockchain hardware [28], as well as many others. In this section, we describe some pieces of research in securing audit logging, with particular attention on distributed systems and cloud computing; we describe blockchain-based mechanisms later in the following subsection.…”

“…Audit logs are used to keep track of important events about system activities and are a fundamental mechanism for digital forensics because they provide information about past and current events and hence, the path of states of a system [2]. The need for protecting logs from attackers was already stated by various researchers in different contexts, in the context of hardware [3]; systems [4,5]; file systems [6]; databases [7]; and secure logging protocols [8]. Companies are currently attracted to migrate to cloud computing services [9].…”

AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reports

“…Threat Detection with Cyber Intelligence Recent advancements of causality analysis in system auditing [19,31,32,42] have enabled security investigators to detect cyber attacks with multiple stages. However, audit logs monitor general-purpose system activities and thus lack the knowledge of high-level behaviors [48]. In most cases, analysts act as the backbone in SOCs (security operations center) to correlate various attack stages through reviewing numerous system logs [45].…”

Exploration of Enterprise Server Data to Assess Ease of Modeling System Behavior

“…The other group of approaches is more systemcentric and mainly seeks to developing capabilities that can either identify suspicious patterns in system execution in relation to previously observed attacker actions [6,[19][20][21] or characterize the normal system behavior through developing models [8,[22][23][24]. More recently, as part of DARPA's Transparent Computing (TC) program [25,26] a new wave of techniques based on data provenance analysis has appeared.…”