System Misuse Detection via Informed Behavior Clustering and Modeling
One of the main tasks of cybersecurity is recognizing malicious interactions with an arbitrary system. Currently, the logging information from each interaction can be collected in almost unrestricted amounts, but identification of attacks requires a lot of effort and time of security experts. We propose an approach for identifying fraud activity through modeling normal behavior in interactions with a system via machine learning methods, in particular LSTM neural networks. In order to enrich the modeling with system specific knowledge, we propose to use an interactive visual interface that allows security experts to identify semantically meaningful clusters of interactions. These clusters incorporate domain knowledge and lead to more precise behavior modeling via informed machine learning. We evaluate the proposed approach on a dataset containing logs of interactions with an administrative interface of login and security server. Our empirical results indicate that the informed modeling is capable of capturing normal behavior, which can then be used to detect abnormal behavior.
Code (0)
등록된 구현이 없습니다.
Tasks
BIG-bench Machine LearningClusteringMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data
Generative, multimodal artificial intelligence (GenAI) offers transformative potential across industries, but its misuse poses significant risks. Prior research has shed light on the potential of advanced AI systems to b…
Detecting Safety Violations Across Many Agent Traces
To identify safety violations, auditors often search over large sets of agent traces. This search is difficult because failures are often rare, complex, and sometimes even adversarially hidden and only detectable when mu…
Spectrum Sensing under Spectrum Misuse Behaviors: A Multi-Hypothesis Test Perspective
Spectrum misuse behaviors, brought either by illegitimate access or by rogue power emission, endanger the legitimate communication and deteriorate the spectrum usage environment. In this paper, our aim is to detect wheth…
Machine Learning Applications in Misuse and Anomaly Detection
Machine learning and data mining algorithms play important roles in designing intrusion detection systems. Based on their approaches toward the detection of attacks in a network, intrusion detection systems can be broadl…
Anomaly DetectionBIG-bench Machine LearningIntrusion DetectionNetwork Intrusion DetectionStateful Online Monitoring Catches Distributed Agent Attacks
Language models can find thousands of severe software vulnerabilities, and agents are increasingly being misused for cyberattacks. To avoid detection, attackers frequently distribute their misuse, splitting a harmful tas…