WEAPON: Uma Arquitetura para Detecção de Anomalias de Comportamento do Usuário
Resumo
A detecção de anomalias de comportamento de usuário vem sendo aplicada com sucesso no campo da segurança cibernética. Grande parte da literatura correlata aborda essa questão sem considerar a individualização dos usuários ao analisar logs dos dispositivos de proteção de redes e sistemas. Este trabalho apresenta o WEAPON, uma arquitetura para a detecção de anomalias de comportamento, considerando a individualidade de cada usuário, com base em Wide and Deep Convolutional LSTM Autoencoders. Quando comparado com outras abordagens, o WEAPON mostrou ser mais eficiente, superando em até 7% o segundo melhor modelo no processo de detecção de anomalias.
Palavras-chave:
Detecção de anomalias de comportamento de usuário, Aprendizado de máquinas, Autoencoders, Detecção de novidade
Referências
Abu Sulayman, I. I. and Ouda, A. (2019). User Modeling via Anomaly Detection Techniques for User Authentication. 2019 IEEE 10th Annual Information Technology, Electronics and Mobile Communication Conference, IEMCON 2019, pages 169–176.
Aggarwal, C. C. (2017). Outlier Analysis. Springer Publishing Company, Incorporated, 2nd edition.
Agrawal, S. and Agrawal, J. (2015). Survey on anomaly detection using data mining techniques. Procedia Computer Science, 60(1):708–713.
Ahmed, M., Naser Mahmood, A., and Hu, J. (2016). A survey of network anomaly detection techniques. J. Netw. Comput. Appl., 60(C):19–31.
Filho, G. P., Ueyama, J., Villas, L. A., Pinto, A. R., Goncalves, V. P., Pessin, G., Pazzi, R. W., and Braun, T. (2014). Nodepm: a remote monitoring alert system for energy consumption using probabilistic techniques. Sensors, 14(1):848–867.
Gao, Y., Ma, Y., and Li, D. (2017). Anomaly detection of malicious users’ behaviors for web applications based on web logs. In 2017 IEEE 17th International Conference on Communication Technology (ICCT), pages 1352–1355.
Geraldo Filho, P., Ueyama, J., Villas, L., Pinto, A., and Seraphini, S. (2013). Nodepm: Um sistema de monitoramento remoto do consumo de energia elétrica via redes de sensores sem fio. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), editor, Sociedade Brasileira de Computação (SBC), 31:17–30.
Glasser, J. and Lindauer, B. (2013). Bridging the gap: A pragmatic approach to generating insider threat data. In 2013 IEEE Security and Privacy Workshops, pages 98–104.
Gupta, M., Gao, J., Aggarwal, C. C., and Han, J. (2014). Outlier Detection for Temporal Data: A Survey. IEEE Transactions on Knowledge and Data Engineering, 26(9):2250– 2267.
Jin, Y., Qiu, C., Sun, L., Peng, X., and Zhou, J. (2017). Anomaly detection in time series via robust PCA. 2017 2nd IEEE International Conference on Intelligent Transportation Engineering, ICITE 2017, pages 352–355.
Junior, G., Carvalho, L. C., Rodrigues, J. R., and Proença, M. P. (2016). Network anomaly detection using IP flows with principal component analysis and ant colony optimization. Journal of Network and Computer Applications, 64(1):1–11.
Kim, J., Park, M., Kim, H., Cho, S., and Kang, P. (2019). Insider threat detection based on user behavior modeling and anomaly detection algorithms. Applied Sciences (Switzerland), 9(19).
Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., and Kim, K. J. (2017). A survey of deep learning-based network anomaly detection. Cluster Computing, 22:949–961.
Lindauer, B. (2020). Insider threat test dataset. https://kilthub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247/1.
Pang, G., Shen, C., Cao, L., and Hengel, A. V. D. (2021). Deep learning for anomaly detection: A review. ACM Comput. Surv., 54(2).
Patcha, A. and Park, J. M. (2007). An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks, 51(12):3448–3470.
Pokhrel, R., Pokharel, P., and Kumar Timalsina, A. (2019). Anomaly-Based – Intrusion Detection System using User Profile Generated from System Logs. International Journal of Scientific and Research Publications (IJSRP), 9(2):p8631.
Prarthana, T. S. and Gangadhar, N. D. (2017). User behaviour anomaly detection in multidimensional data. In 2017 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM), pages 3–10.
Prasad, N. R., Almanza-Garcia, S., and Lu, T. T. (2009). Anomaly detection. Computers, Materials and Continua, 14(1):1–22.
Qu, Z., Su, L., Wang, X., Zheng, S., Song, X., and Song, X. (2018). A Unsupervised Learning Method of Anomaly Detection Using GRU. Proceedings 2018 IEEE International Conference on Big Data and Smart Computing, BigComp 2018, pages 685–688.
Ratner, A., Bach, S., Ehrenberg, H., Fries, J., Wu, S., and Ré, C. (2020). Snorkel: rapid training data creation with weak supervision. The VLDB Journal, 29.
Sadik, M. S. and Gruenwald, L. (2014). Research issues in outlier detection for data streams. ACM SIGKDD Explorations Newsletter, 15:33–40.
Shin, K., Hooi, B., Kim, J., and Faloutsos, C. (2021). Detecting group anomalies in tera-scale multi-aspect data via dense-subtensor mining. Frontiers in Big Data, 3.
Thomé, M., Prestes, A., Gomes, R., and Mota, V. (2020). Um arcabouço para detecção In Anais do XXXVIII e alerta de anomalias de mobilidade urbana em tempo real. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos, pages 784– 797, Porto Alegre, RS, Brasil. SBC.
Thudumu, S., Branch, P., Jin, J., and Singh, J. J. (2020). A comprehensive survey of anomaly detection techniques for high dimensional big data. Journal of Big Data, 7(1):1–30.
Vilaça, E. S. C., Vieira, T. P. B., de Sousa, R. T., and da Costa, J. P. C. L. (2019). Botnet traffic detection using RPCA and mahalanobis distance. In 2019 Workshop on Communication Networks and Power Systems (WCNPS), pages 1–6.
Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., and Yin, M. (2021). Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning. Security and Communication Networks, 2021.
Zhao, Y., Nasrullah, Z., and Li, Z. (2019). Pyod: A python toolbox for scalable outlier detection. Journal of Machine Learning Research.
Aggarwal, C. C. (2017). Outlier Analysis. Springer Publishing Company, Incorporated, 2nd edition.
Agrawal, S. and Agrawal, J. (2015). Survey on anomaly detection using data mining techniques. Procedia Computer Science, 60(1):708–713.
Ahmed, M., Naser Mahmood, A., and Hu, J. (2016). A survey of network anomaly detection techniques. J. Netw. Comput. Appl., 60(C):19–31.
Filho, G. P., Ueyama, J., Villas, L. A., Pinto, A. R., Goncalves, V. P., Pessin, G., Pazzi, R. W., and Braun, T. (2014). Nodepm: a remote monitoring alert system for energy consumption using probabilistic techniques. Sensors, 14(1):848–867.
Gao, Y., Ma, Y., and Li, D. (2017). Anomaly detection of malicious users’ behaviors for web applications based on web logs. In 2017 IEEE 17th International Conference on Communication Technology (ICCT), pages 1352–1355.
Geraldo Filho, P., Ueyama, J., Villas, L., Pinto, A., and Seraphini, S. (2013). Nodepm: Um sistema de monitoramento remoto do consumo de energia elétrica via redes de sensores sem fio. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), editor, Sociedade Brasileira de Computação (SBC), 31:17–30.
Glasser, J. and Lindauer, B. (2013). Bridging the gap: A pragmatic approach to generating insider threat data. In 2013 IEEE Security and Privacy Workshops, pages 98–104.
Gupta, M., Gao, J., Aggarwal, C. C., and Han, J. (2014). Outlier Detection for Temporal Data: A Survey. IEEE Transactions on Knowledge and Data Engineering, 26(9):2250– 2267.
Jin, Y., Qiu, C., Sun, L., Peng, X., and Zhou, J. (2017). Anomaly detection in time series via robust PCA. 2017 2nd IEEE International Conference on Intelligent Transportation Engineering, ICITE 2017, pages 352–355.
Junior, G., Carvalho, L. C., Rodrigues, J. R., and Proença, M. P. (2016). Network anomaly detection using IP flows with principal component analysis and ant colony optimization. Journal of Network and Computer Applications, 64(1):1–11.
Kim, J., Park, M., Kim, H., Cho, S., and Kang, P. (2019). Insider threat detection based on user behavior modeling and anomaly detection algorithms. Applied Sciences (Switzerland), 9(19).
Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., and Kim, K. J. (2017). A survey of deep learning-based network anomaly detection. Cluster Computing, 22:949–961.
Lindauer, B. (2020). Insider threat test dataset. https://kilthub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247/1.
Pang, G., Shen, C., Cao, L., and Hengel, A. V. D. (2021). Deep learning for anomaly detection: A review. ACM Comput. Surv., 54(2).
Patcha, A. and Park, J. M. (2007). An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks, 51(12):3448–3470.
Pokhrel, R., Pokharel, P., and Kumar Timalsina, A. (2019). Anomaly-Based – Intrusion Detection System using User Profile Generated from System Logs. International Journal of Scientific and Research Publications (IJSRP), 9(2):p8631.
Prarthana, T. S. and Gangadhar, N. D. (2017). User behaviour anomaly detection in multidimensional data. In 2017 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM), pages 3–10.
Prasad, N. R., Almanza-Garcia, S., and Lu, T. T. (2009). Anomaly detection. Computers, Materials and Continua, 14(1):1–22.
Qu, Z., Su, L., Wang, X., Zheng, S., Song, X., and Song, X. (2018). A Unsupervised Learning Method of Anomaly Detection Using GRU. Proceedings 2018 IEEE International Conference on Big Data and Smart Computing, BigComp 2018, pages 685–688.
Ratner, A., Bach, S., Ehrenberg, H., Fries, J., Wu, S., and Ré, C. (2020). Snorkel: rapid training data creation with weak supervision. The VLDB Journal, 29.
Sadik, M. S. and Gruenwald, L. (2014). Research issues in outlier detection for data streams. ACM SIGKDD Explorations Newsletter, 15:33–40.
Shin, K., Hooi, B., Kim, J., and Faloutsos, C. (2021). Detecting group anomalies in tera-scale multi-aspect data via dense-subtensor mining. Frontiers in Big Data, 3.
Thomé, M., Prestes, A., Gomes, R., and Mota, V. (2020). Um arcabouço para detecção In Anais do XXXVIII e alerta de anomalias de mobilidade urbana em tempo real. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos, pages 784– 797, Porto Alegre, RS, Brasil. SBC.
Thudumu, S., Branch, P., Jin, J., and Singh, J. J. (2020). A comprehensive survey of anomaly detection techniques for high dimensional big data. Journal of Big Data, 7(1):1–30.
Vilaça, E. S. C., Vieira, T. P. B., de Sousa, R. T., and da Costa, J. P. C. L. (2019). Botnet traffic detection using RPCA and mahalanobis distance. In 2019 Workshop on Communication Networks and Power Systems (WCNPS), pages 1–6.
Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., and Yin, M. (2021). Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning. Security and Communication Networks, 2021.
Zhao, Y., Nasrullah, Z., and Li, Z. (2019). Pyod: A python toolbox for scalable outlier detection. Journal of Machine Learning Research.
Publicado
31/07/2022
Como Citar
MOLINA, Andre L. B.; GONÇALVES, Vinícius P.; SOUSA JR., Rafael T. de; GIUNTINI, Felipe T.; PESSIN, Gustavo; MENEGUETTE, Rodolfo I.; ROCHA FILHO, Geraldo P..
WEAPON: Uma Arquitetura para Detecção de Anomalias de Comportamento do Usuário. In: BRAZILIAN WORKSHOP ON SOCIAL NETWORK ANALYSIS AND MINING (BRASNAM), 11. , 2022, Niterói.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2022
.
p. 121-132.
ISSN 2595-6094.
DOI: https://doi.org/10.5753/brasnam.2022.222954.
