TY  - JOUR
A1  - Sapegin, Andrey
A1  - Jaeger, David
A1  - Cheng, Feng
A1  - Meinel, Christoph
T1  - Towards a system for complex analysis of security events in large-scale networks
JF  - Computers & security : the international journal devoted to the study of the technical and managerial aspects of computer security
N2  - After almost two decades of development, modern Security Information and Event Management (SIEM) systems still face issues with normalisation of heterogeneous data sources, high number of false positive alerts and long analysis times, especially in large-scale networks with high volumes of security events. In this paper, we present our own prototype of SIEM system, which is capable of dealing with these issues. For efficient data processing, our system employs in-memory data storage (SAP HANA) and our own technologies from the previous work, such as the Object Log Format (OLF) and high-speed event normalisation. We analyse normalised data using a combination of three different approaches for security analysis: misuse detection, query-based analytics, and anomaly detection. Compared to the previous work, we have significantly improved our unsupervised anomaly detection algorithms. Most importantly, we have developed a novel hybrid outlier detection algorithm that returns ranked clusters of anomalies. It lets an operator of a SIEM system to concentrate on the several top-ranked anomalies, instead of digging through an unsorted bundle of suspicious events. We propose to use anomaly detection in a combination with signatures and queries, applied on the same data, rather than as a full replacement for misuse detection. In this case, the majority of attacks will be captured with misuse detection, whereas anomaly detection will highlight previously unknown behaviour or attacks. We also propose that only the most suspicious event clusters need to be checked by an operator, whereas other anomalies, including false positive alerts, do not need to be explicitly checked if they have a lower ranking. We have proved our concepts and algorithms on a dataset of 160 million events from a network segment of a big multinational company and suggest that our approach and methods are highly relevant for modern SIEM systems.
KW  - Intrusion detection
KW  - SAP HANA
KW  - In-memory
KW  - Security
KW  - Machine learning
KW  - Anomaly detection
KW  - Outlier detection
Y1  - 2017
U6  - https://doi.org/10.1016/j.cose.2017.02.001
SN  - 0167-4048
SN  - 1872-6208
VL  - 67
SP  - 16
EP  - 34
PB  - Elsevier Science
CY  - Oxford
ER  - 
TY  - JOUR
A1  - Aa, Han van der
A1  - Rebmann, Adrian
A1  - Leopold, Henrik
T1  - Natural language-based detection of semantic execution anomalies in event logs
JF  - Information systems : IS ; an international journal ; data bases
N2  - Anomaly detection in process mining aims to recognize outlying or unexpected behavior in event logs for purposes such as the removal of noise and identification of conformance violations. Existing techniques for this task are primarily frequency-based, arguing that behavior is anomalous because it is uncommon. However, such techniques ignore the semantics of recorded events and, therefore, do not take the meaning of potential anomalies into consideration. In this work, we overcome this caveat and focus on the detection of anomalies from a semantic perspective, arguing that anomalies can be recognized when process behavior does not make sense. To achieve this, we propose an approach that exploits the natural language associated with events. Our key idea is to detect anomalous process behavior by identifying semantically inconsistent execution patterns. To detect such patterns, we first automatically extract business objects and actions from the textual labels of events. We then compare these against a process-independent knowledge base. By populating this knowledge base with patterns from various kinds of resources, our approach can be used in a range of contexts and domains. We demonstrate the capability of our approach to successfully detect semantic execution anomalies through an evaluation based on a set of real-world and synthetic event logs and show the complementary nature of semantics-based anomaly detection to existing frequency-based techniques.
KW  - Process mining
KW  - Natural language processing
KW  - Anomaly detection
Y1  - 2021
U6  - https://doi.org/10.1016/j.is.2021.101824
SN  - 0306-4379
SN  - 1873-6076
VL  - 102
PB  - Elsevier
CY  - Amsterdam
ER  -