Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

By Alina Oprea, Zhou Li, T. Yen, Sang Chin, Sumayah A. Alrwais. 2014

186 citations recorded by the source corpus.

Recent years have seen the rise of sophisticated attacks including advanced persistent threats (APT) which pose severe risks to organizations and governments. Additionally, new malware strains appear at a higher rate than ever before. Since many of these malware evade existing security products, traditional defenses deployed by enterprises today often fail at detecting infections at an early stage. We address the problem of detecting early-stage APT infection by proposing a new framework based on belief propagation inspired from graph theory. We demonstrate that our techniques perform well on two large datasets. We achieve high accuracy on two months of DNS logs released by Los Alamos National Lab (LANL), which include APT infection attacks simulated by LANL domain experts. We also apply our algorithms to 38TB of web proxy logs collected at the border of a large enterprise and identify hundreds of malicious domains overlooked by state-of-the-art security products.

Subfields: Artificial Intelligence, Computer Networks and Communications, Information Systems

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Information Systems

Citations in the corpus

Attacking Graph-based Classification via Manipulating the Graph Structure (2019, background): “ems such as malware detection [14, 59], fraudulent user detection in social networks [10, 25, 36, 67, 68, 72, 74], fake review detection [1, 65], auction fraud detection [47], APT infection detection [46], and attribute inference [26, 27, 37]. Specifically, given 1) a graph (undirected or directed) ”
DÏoT: A Federated Self-learning Anomaly Detection System for IoT (2018, background): “[48] use deep belief networks for mining DNS log data and detect infections in enterprise networks.”
Graph-based Security and Privacy Analytics via Collective Classification with Joint Weight Learning and Propagation (2018, background): “…to various security and privacy problems, including malware detection [2]–[6], Sybil detection in social networks [7]–[22], fake review detection [23]– [25], malicious website detection [26]–[28], auction fraud detection [29], APT infection detection [30], and attribute inference attacks [31]–[37].”
Robust log-based anomaly detection on unstable log data (2019, unknown): “There have been a lot of studies on log-based anomaly detection[2, 4, 7, 11, 12, 14, 15, 20, 26, 28, 29, 33–35, 38, 41].”
Tools and Benchmarks for Automated Log Parsing (2018, background): “The rich information, as well as the pervasiveness, of logs enables a wide variety of system management and diagnostic tasks, such as analyzing usage statistics [1], ensuring application security [2], identifying performance anomalies [3], [4], and diagnosing errors and crashes [5], [6].”
POIROT: Aligning Attack Behavior with Kernel Audit Records for Cyber Threat Hunting (2019, background): “[51] leverage DNS or web proxy logs for detecting early-stage infection in an enterprise.”