WEAPON: An Architecture for User Behavior Anomaly Detection
Abstract
User behavior anomaly detection has been a successful measure contributing to cybersecurity. Much of the related literature addresses this issue without considering the individualization of users when analyzing logs generated by network and system protection devices. This paper presents WEAPON, an architecture for the detection of behavior anomalies, considering the individuality of each user, based on Wide and Deep Convolutional LSTM Autoencoders. When compared to other approaches, WEAPON proved to be more efficient, surpassing by up to 7% the second best model in the anomaly detection process.
Keywords:
User behavior anomaly detection, machine learning, Autoencoders, Novelty detection
References
Abu Sulayman, I. I. and Ouda, A. (2019). User Modeling via Anomaly Detection Techniques for User Authentication. 2019 IEEE 10th Annual Information Technology, Electronics and Mobile Communication Conference, IEMCON 2019, pages 169–176.
Aggarwal, C. C. (2017). Outlier Analysis. Springer Publishing Company, Incorporated, 2nd edition.
Agrawal, S. and Agrawal, J. (2015). Survey on anomaly detection using data mining techniques. Procedia Computer Science, 60(1):708–713.
Ahmed, M., Naser Mahmood, A., and Hu, J. (2016). A survey of network anomaly detection techniques. J. Netw. Comput. Appl., 60(C):19–31.
Filho, G. P., Ueyama, J., Villas, L. A., Pinto, A. R., Goncalves, V. P., Pessin, G., Pazzi, R. W., and Braun, T. (2014). Nodepm: a remote monitoring alert system for energy consumption using probabilistic techniques. Sensors, 14(1):848–867.
Gao, Y., Ma, Y., and Li, D. (2017). Anomaly detection of malicious users’ behaviors for web applications based on web logs. In 2017 IEEE 17th International Conference on Communication Technology (ICCT), pages 1352–1355.
Geraldo Filho, P., Ueyama, J., Villas, L., Pinto, A., and Seraphini, S. (2013). Nodepm: Um sistema de monitoramento remoto do consumo de energia elétrica via redes de sensores sem fio. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), editor, Sociedade Brasileira de Computação (SBC), 31:17–30.
Glasser, J. and Lindauer, B. (2013). Bridging the gap: A pragmatic approach to generating insider threat data. In 2013 IEEE Security and Privacy Workshops, pages 98–104.
Gupta, M., Gao, J., Aggarwal, C. C., and Han, J. (2014). Outlier Detection for Temporal Data: A Survey. IEEE Transactions on Knowledge and Data Engineering, 26(9):2250– 2267.
Jin, Y., Qiu, C., Sun, L., Peng, X., and Zhou, J. (2017). Anomaly detection in time series via robust PCA. 2017 2nd IEEE International Conference on Intelligent Transportation Engineering, ICITE 2017, pages 352–355.
Junior, G., Carvalho, L. C., Rodrigues, J. R., and Proença, M. P. (2016). Network anomaly detection using IP flows with principal component analysis and ant colony optimization. Journal of Network and Computer Applications, 64(1):1–11.
Kim, J., Park, M., Kim, H., Cho, S., and Kang, P. (2019). Insider threat detection based on user behavior modeling and anomaly detection algorithms. Applied Sciences (Switzerland), 9(19).
Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., and Kim, K. J. (2017). A survey of deep learning-based network anomaly detection. Cluster Computing, 22:949–961.
Lindauer, B. (2020). Insider threat test dataset. https://kilthub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247/1.
Pang, G., Shen, C., Cao, L., and Hengel, A. V. D. (2021). Deep learning for anomaly detection: A review. ACM Comput. Surv., 54(2).
Patcha, A. and Park, J. M. (2007). An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks, 51(12):3448–3470.
Pokhrel, R., Pokharel, P., and Kumar Timalsina, A. (2019). Anomaly-Based – Intrusion Detection System using User Profile Generated from System Logs. International Journal of Scientific and Research Publications (IJSRP), 9(2):p8631.
Prarthana, T. S. and Gangadhar, N. D. (2017). User behaviour anomaly detection in multidimensional data. In 2017 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM), pages 3–10.
Prasad, N. R., Almanza-Garcia, S., and Lu, T. T. (2009). Anomaly detection. Computers, Materials and Continua, 14(1):1–22.
Qu, Z., Su, L., Wang, X., Zheng, S., Song, X., and Song, X. (2018). A Unsupervised Learning Method of Anomaly Detection Using GRU. Proceedings 2018 IEEE International Conference on Big Data and Smart Computing, BigComp 2018, pages 685–688.
Ratner, A., Bach, S., Ehrenberg, H., Fries, J., Wu, S., and Ré, C. (2020). Snorkel: rapid training data creation with weak supervision. The VLDB Journal, 29.
Sadik, M. S. and Gruenwald, L. (2014). Research issues in outlier detection for data streams. ACM SIGKDD Explorations Newsletter, 15:33–40.
Shin, K., Hooi, B., Kim, J., and Faloutsos, C. (2021). Detecting group anomalies in tera-scale multi-aspect data via dense-subtensor mining. Frontiers in Big Data, 3.
Thomé, M., Prestes, A., Gomes, R., and Mota, V. (2020). Um arcabouço para detecção In Anais do XXXVIII e alerta de anomalias de mobilidade urbana em tempo real. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos, pages 784– 797, Porto Alegre, RS, Brasil. SBC.
Thudumu, S., Branch, P., Jin, J., and Singh, J. J. (2020). A comprehensive survey of anomaly detection techniques for high dimensional big data. Journal of Big Data, 7(1):1–30.
Vilaça, E. S. C., Vieira, T. P. B., de Sousa, R. T., and da Costa, J. P. C. L. (2019). Botnet traffic detection using RPCA and mahalanobis distance. In 2019 Workshop on Communication Networks and Power Systems (WCNPS), pages 1–6.
Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., and Yin, M. (2021). Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning. Security and Communication Networks, 2021.
Zhao, Y., Nasrullah, Z., and Li, Z. (2019). Pyod: A python toolbox for scalable outlier detection. Journal of Machine Learning Research.
Aggarwal, C. C. (2017). Outlier Analysis. Springer Publishing Company, Incorporated, 2nd edition.
Agrawal, S. and Agrawal, J. (2015). Survey on anomaly detection using data mining techniques. Procedia Computer Science, 60(1):708–713.
Ahmed, M., Naser Mahmood, A., and Hu, J. (2016). A survey of network anomaly detection techniques. J. Netw. Comput. Appl., 60(C):19–31.
Filho, G. P., Ueyama, J., Villas, L. A., Pinto, A. R., Goncalves, V. P., Pessin, G., Pazzi, R. W., and Braun, T. (2014). Nodepm: a remote monitoring alert system for energy consumption using probabilistic techniques. Sensors, 14(1):848–867.
Gao, Y., Ma, Y., and Li, D. (2017). Anomaly detection of malicious users’ behaviors for web applications based on web logs. In 2017 IEEE 17th International Conference on Communication Technology (ICCT), pages 1352–1355.
Geraldo Filho, P., Ueyama, J., Villas, L., Pinto, A., and Seraphini, S. (2013). Nodepm: Um sistema de monitoramento remoto do consumo de energia elétrica via redes de sensores sem fio. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos (SBRC), editor, Sociedade Brasileira de Computação (SBC), 31:17–30.
Glasser, J. and Lindauer, B. (2013). Bridging the gap: A pragmatic approach to generating insider threat data. In 2013 IEEE Security and Privacy Workshops, pages 98–104.
Gupta, M., Gao, J., Aggarwal, C. C., and Han, J. (2014). Outlier Detection for Temporal Data: A Survey. IEEE Transactions on Knowledge and Data Engineering, 26(9):2250– 2267.
Jin, Y., Qiu, C., Sun, L., Peng, X., and Zhou, J. (2017). Anomaly detection in time series via robust PCA. 2017 2nd IEEE International Conference on Intelligent Transportation Engineering, ICITE 2017, pages 352–355.
Junior, G., Carvalho, L. C., Rodrigues, J. R., and Proença, M. P. (2016). Network anomaly detection using IP flows with principal component analysis and ant colony optimization. Journal of Network and Computer Applications, 64(1):1–11.
Kim, J., Park, M., Kim, H., Cho, S., and Kang, P. (2019). Insider threat detection based on user behavior modeling and anomaly detection algorithms. Applied Sciences (Switzerland), 9(19).
Kwon, D., Kim, H., Kim, J., Suh, S. C., Kim, I., and Kim, K. J. (2017). A survey of deep learning-based network anomaly detection. Cluster Computing, 22:949–961.
Lindauer, B. (2020). Insider threat test dataset. https://kilthub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247/1.
Pang, G., Shen, C., Cao, L., and Hengel, A. V. D. (2021). Deep learning for anomaly detection: A review. ACM Comput. Surv., 54(2).
Patcha, A. and Park, J. M. (2007). An overview of anomaly detection techniques: Existing solutions and latest technological trends. Computer Networks, 51(12):3448–3470.
Pokhrel, R., Pokharel, P., and Kumar Timalsina, A. (2019). Anomaly-Based – Intrusion Detection System using User Profile Generated from System Logs. International Journal of Scientific and Research Publications (IJSRP), 9(2):p8631.
Prarthana, T. S. and Gangadhar, N. D. (2017). User behaviour anomaly detection in multidimensional data. In 2017 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM), pages 3–10.
Prasad, N. R., Almanza-Garcia, S., and Lu, T. T. (2009). Anomaly detection. Computers, Materials and Continua, 14(1):1–22.
Qu, Z., Su, L., Wang, X., Zheng, S., Song, X., and Song, X. (2018). A Unsupervised Learning Method of Anomaly Detection Using GRU. Proceedings 2018 IEEE International Conference on Big Data and Smart Computing, BigComp 2018, pages 685–688.
Ratner, A., Bach, S., Ehrenberg, H., Fries, J., Wu, S., and Ré, C. (2020). Snorkel: rapid training data creation with weak supervision. The VLDB Journal, 29.
Sadik, M. S. and Gruenwald, L. (2014). Research issues in outlier detection for data streams. ACM SIGKDD Explorations Newsletter, 15:33–40.
Shin, K., Hooi, B., Kim, J., and Faloutsos, C. (2021). Detecting group anomalies in tera-scale multi-aspect data via dense-subtensor mining. Frontiers in Big Data, 3.
Thomé, M., Prestes, A., Gomes, R., and Mota, V. (2020). Um arcabouço para detecção In Anais do XXXVIII e alerta de anomalias de mobilidade urbana em tempo real. Simpósio Brasileiro de Redes de Computadores e Sistemas Distribuídos, pages 784– 797, Porto Alegre, RS, Brasil. SBC.
Thudumu, S., Branch, P., Jin, J., and Singh, J. J. (2020). A comprehensive survey of anomaly detection techniques for high dimensional big data. Journal of Big Data, 7(1):1–30.
Vilaça, E. S. C., Vieira, T. P. B., de Sousa, R. T., and da Costa, J. P. C. L. (2019). Botnet traffic detection using RPCA and mahalanobis distance. In 2019 Workshop on Communication Networks and Power Systems (WCNPS), pages 1–6.
Zhang, C., Wang, S., Zhan, D., Yu, T., Wang, T., and Yin, M. (2021). Detecting Insider Threat from Behavioral Logs Based on Ensemble and Self-Supervised Learning. Security and Communication Networks, 2021.
Zhao, Y., Nasrullah, Z., and Li, Z. (2019). Pyod: A python toolbox for scalable outlier detection. Journal of Machine Learning Research.
Published
2022-07-31
How to Cite
MOLINA, Andre L. B.; GONÇALVES, Vinícius P.; SOUSA JR., Rafael T. de; GIUNTINI, Felipe T.; PESSIN, Gustavo; MENEGUETTE, Rodolfo I.; ROCHA FILHO, Geraldo P..
WEAPON: An Architecture for User Behavior Anomaly Detection. In: BRAZILIAN WORKSHOP ON SOCIAL NETWORK ANALYSIS AND MINING (BRASNAM), 11. , 2022, Niterói.
Anais [...].
Porto Alegre: Sociedade Brasileira de Computação,
2022
.
p. 121-132.
ISSN 2595-6094.
DOI: https://doi.org/10.5753/brasnam.2022.222954.
