Paper Info
Title
GraphBAD: A general technique for anomaly detection in security information and event management.
Abstract
The reliance on expert knowledge-required for analysing security logs and performing security audits-has created an unhealthy balance, where many computer users are not able to correctly audit their security configurations and react to potential security threats. The decreasing cost of IT and the increasing use of technology in domestic life are exacerbating this problem, where small companies and home IT users are not able to afford the price of experts for auditing their system configuration. In this paper, we present GraphBAD, a graph-based analysis tool that is able to analyse security configurations in order to identify anomalies that could lead to potential security risks. GraphBAD, which does not require any prior domain knowledge, generates graph-based models from security configuration data and, by analysing such models, is able to propose mitigation plans that can help computer users in increasing the security of their systems. A large experimental analysis, conducted on both publicly available (the well-known KDD dataset) and synthetically generated testing sets (file system permissions), demonstrates the ability of GraphBAD in correctly identifying security configuration anomalies and suggesting appropriate mitigation plans.
Year
DOI
Venue
2018
10.1002/cpe.4433
CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE
Keywords
Field
DocType
anomaly detection,graph structure,log files,security auditing,SIEM
Anomaly detection,Graph,Audit,Domain knowledge,Computer security,Computer science,Security information and event management,File system permissions,Distributed computing
Journal
Volume
Issue
ISSN
30
16
1532-0626
Citations 
PageRank 
References 
2
0.38
18
Authors
4
Name
Order
Citations
PageRank
Simon Parkinson111314.14
Mauro Vallati221646.63
Andrew Crampton3264.95
Shirin Sohrabi436624.25