Entity Embedding-Based Anomaly Detection for Heterogeneous Categorical Events

By Ting-Li Chen, Lu An Tang, Yizhou Sun, Zhengzhang Chen, Kai Zhang. 2016

91 citations recorded by the source corpus.

Anomaly detection plays an important role in modern data-driven security applications, such as detecting suspicious access to a socket from a process. In many cases, such events can be described as a collection of categorical values that are considered as entities of different types, which we call heterogeneous categorical events. Due to the lack of intrinsic distance measures among entities, and the exponentially large event space, most existing work relies heavily on heuristics to calculate abnormal scores for events. Different from previous work, we propose a principled and unified probabilistic model APE (Anomaly detection via Probabilistic pairwise interaction and Entity embedding) that directly models the likelihood of events. In this model, we embed entities into a common latent space using their observed co-occurrence in different events. More specifically, we first model the compatibility of each pair of entities according to their embeddings. Then we utilize the weighted pairwise interactions of different entity types to define the event probability. Using Noise-Contrastive Estimation with "context-dependent" noise distribution, our model can be learned efficiently regardless of the large event space. Experimental results on real enterprise surveillance data show that our methods can accurately detect abnormal events compared to other state-of-the-art abnormal detection techniques.

Subfields: Artificial Intelligence, Computer Networks and Communications, Epidemiology, Representation & Self-Supervised Learning

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Epidemiology

In Representation & Self-Supervised Learning

Citations in the corpus

On Sampling Strategies for Neural Network-based Collaborative Filtering (2017, methodology): “Compared to traditional feature detectors, such as SIFT and n-grams, DNNs and other embedding methods [5, 6, 29] can automatically extract better features that produce higher performance in various tasks.”
You Are What You Do: Hunting Stealthy Malware via Data Provenance Analysis (2020, methodology): “Anomaly Detection with Host Level System Events Several approaches have been proposed to detect intrusion or abnormal behaviors using system event data on the end hosts [74], [75], [36], [22], [14].”
Deep Learning for Anomaly Detection (2020, methodology): “2) Weak Anomaly scores No No No MLP ReLU 2-4 Deviation Tabular APE [30] (6.”
Task-Guided and Path-Augmented Heterogeneous Network Embedding for Author Identification (2016, background): “Network embedding also attracts lots of attentions in recent years [17, 26, 25, 6, 7].”
NoDoze: Combatting Threat Alert Fatigue with Automated Provenance Triage (2019, methodology): “The first research question of our evaluation is how much NODOZE improves the accuracy of existing TDS [31], [43], [29], [60] which are based on heuristics and single event matching rules.”
Joint Text Embedding for Personalized Content-based Recommendation (2017, methodology): “xt embedding from large-scale unlabeled corpora. 2.3 Text Embedding Recent advances in deep learning have demonstrated the importance of learning good representations for text and other types of data [2, 4, 12, 16, 18, 19]. Text embedding techniques aim at mapping text into vector representation tha”
Who Are the Phishers? Phishing Scam Detection on Ethereum via Network Embedding (2019, background): “Some of these anomaly detection techniques propose their own embedding methods based on the characteristics of the network [27], [28], while some others adopt existing embedding methods.”
Survey on categorical data for neural networks (2020, unknown): “Entity embedding categorical data from computing system events for intrusion detection [30], N/A”