Efficient discovery of abnormal event sequences in enterprise security systems

Boxiang Dong, Zhengzhang Chen, Hui Wang, Lu An Tang, Kai Zhang, Ying Lin, Zhichun Li, Haifeng Chen

Research output: Chapter in Book/Report/Conference proceedingConference contribution

12 Scopus citations

Abstract

Intrusion detection system (IDS) is an important part of enterprise security system architecture. In particular, anomaly-based IDS has been widely applied to detect single abnormal process events that deviate from the majority. However, intrusion activity usually consists of a series of low-level heterogeneous events. The gap between low-level process events and high-level intrusion activities makes it particularly challenging to identify process events that are truly involved in a real malicious activity, and especially considering the massive "noisy" events filling the event sequences. Hence, the existing work that focus on detecting single events can hardly achieve high detection accuracy. In this work, we formulate a novel problem in intrusion detection - suspicious event sequence discovery, and propose GID, an efficient graph-based intrusion detection technique that can identify abnormal event sequences from massive heterogeneous process traces with high accuracy. We fully implement GID and deploy it into a real-world enterprise security system, and it greatly helps detect the advanced threats and optimize the incident response. Executing GID on both static and streaming data shows that GID is efficient (processes about 2 million records per minute) and accurate for intrusion detection.

Original languageEnglish
Title of host publicationCIKM 2017 - Proceedings of the 2017 ACM Conference on Information and Knowledge Management
PublisherAssociation for Computing Machinery
Pages707-715
Number of pages9
ISBN (Electronic)9781450349185
DOIs
StatePublished - 6 Nov 2017
Event26th ACM International Conference on Information and Knowledge Management, CIKM 2017 - Singapore, Singapore
Duration: 6 Nov 201710 Nov 2017

Publication series

NameInternational Conference on Information and Knowledge Management, Proceedings
VolumePart F131841

Other

Other26th ACM International Conference on Information and Knowledge Management, CIKM 2017
CountrySingapore
CitySingapore
Period6/11/1710/11/17

    Fingerprint

Cite this

Dong, B., Chen, Z., Wang, H., Tang, L. A., Zhang, K., Lin, Y., Li, Z., & Chen, H. (2017). Efficient discovery of abnormal event sequences in enterprise security systems. In CIKM 2017 - Proceedings of the 2017 ACM Conference on Information and Knowledge Management (pp. 707-715). (International Conference on Information and Knowledge Management, Proceedings; Vol. Part F131841). Association for Computing Machinery. https://doi.org/10.1145/3132847.3132854