Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks

By T. Yen, Alina Oprea, Kaan Onarlioglu, Todd Leetham, William K. Robertson, Ari Juels, Engin Kirda. Asia-Pacific Computer Systems Architecture Conference, 2013

301 citations recorded by the source corpus.

Subfields: Computer Networks and Communications, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/4a2209626be7c3361348e0bba95b3a280e774049

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

1. Guineng Zheng
2. Vivek Srikumar
3. Qing-Long Han
4. Yang Xiang
5. Min Du
6. Feifei Li
7. Jun Zhang
8. Fabian Monrose

In Information Systems

1. Qing-Long Han
2. Fabian Monrose
3. Min Du
4. Manos Antonakakis
5. Roberto Perdisci
6. Yacin Nadji
7. Alina Oprea
8. Vivek Srikumar

In Signal Processing

1. Fabian Monrose
2. Roberto Perdisci
3. Alina Oprea
4. Feifei Li
5. Jun Zhang
6. Yang Xiang

Citations in the corpus

• Practical Attacks Against Graph-based Clustering (2017, background): “al Machine Learning; Unsupervised Learning; DGA; Network Security 1 INTRODUCTION Network level detection systems are used widely by the community as the first line of defense against Internet threats [9, 20, 27, 29, 33, 41, 63]. These systems often represent the underlying network traffic as a graph”
• LogBERT: Log Anomaly Detection via BERT (2021, unknown): “To tackle this challenge, many rulebased approaches are proposed to identify anomalous events [9], [10].”
• DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning (2017, methodology): “For example, Beehive [41] Session F2: Insights from Log(in)s identifies potential security threats from logs by unsupervised clustering of data-specific features, and then manually labeling outliers.”
• A Survey on Advanced Persistent Threats: Techniques, Solutions, Challenges, and Research Opportunities (2019, background): “Yen et al. [45] proposed an approach to address this problem by extracting information and knowledge from the dirty logs.”
• Detecting and Preventing Cyber Insider Threats: A Survey (2018, methodology): “CERT’s technical reports [3], [6] deeply investigate the indicators an insider threat may have expressed and suggest a series of practices which are essential for mitigating insider threats.”
• Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “Beehive [41] is an unsupervised system identifying general anomalies in an enterprise setting including policy violations and malware distribution.”