Topological Data Analysis for Anomaly Detection in Host-Based Logs
Topological Data Analysis (TDA) gives practioners the ability to analyse the global structure of cybersecurity data. We use TDA for anomaly detection in host-based logs collected with the open-source Logging Made Easy (LME) project. We present an approach that builds a filtration of simplicial complexes directly from Windows logs, enabling analysis of their intrinsic structure using topological tools. We compare the efficacy of persistent homology and the spectrum of graph and hypergraph Laplacians as feature vectors against a standard log embedding that counts events, and find that topological and spectral embeddings of computer logs contain discriminative information for classifying anomalous logs that is complementary to standard embeddings. We end by discussing the potential for our methods to be used as part of an explainable framework for anomaly detection.
Code (0)
등록된 구현이 없습니다.
Tasks
Anomaly DetectionTopological Data AnalysisSimilar Papers 제목 키워드 기반
Topological Data Analysis for Unsupervised Anomaly Detection and Customer Segmentation on Banking Data
This paper introduces advanced techniques of Topological Data Analysis (TDA) for unsupervised anomaly detection and customer segmentation in banking data. Using the Mapper algorithm and persistent homology, we develop un…
Unsupervised Anomaly DetectionLogSHIELD: A Graph-based Real-time Anomaly Detection Framework using Frequency Analysis
Anomaly-based cyber threat detection using deep learning is on a constant growth in popularity for novel cyber-attack detection and forensics. A robust, efficient, and real-time threat detector in a large-scale operation…
Anomaly DetectionCyber Attack DetectionGraph EmbeddingGraph Neural NetworkScatterAD: Temporal-Topological Scattering Mechanism for Time Series Anomaly Detection
One main challenge in time series anomaly detection for industrial IoT lies in the complex spatio-temporal couplings within multivariate data. However, traditional anomaly detection methods focus on modeling spatial or t…
Time Series Anomaly DetectionRepresentation LearningTopological Uncertainty for Anomaly Detection in the Neural-network EoS Inference with Neutron Star Data
We study the performance of the Topological Uncertainty (TU) constructed with a trained feedforward neural network (FNN) for Anomaly Detection. Generally, meaningful information can be stored in the hidden layers of the …
Anomaly DetectionUnsupervised Abnormal Traffic Detection through Topological Flow Analysis
Cyberthreats are a permanent concern in our modern technological world. In the recent years, sophisticated traffic analysis techniques and anomaly detection (AD) algorithms have been employed to face the more and more su…
Anomaly DetectionUnsupervised Anomaly Detection