DAEMON: dynamic auto-encoders for contextualised anomaly detection applied to security monitoring - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2022

DAEMON: dynamic auto-encoders for contextualised anomaly detection applied to security monitoring

Résumé

The slow adoption rate of machine learning-based methods for novel attack detection by Security Operation Centers (SOC) analysts can be partly explained by their lack of data science expertise and the insufficient explainability of the results provided by these approaches. In this paper, we present an anomaly-based detection method that fuses events coming from heterogeneous sources into sets describing the same phenomenons and relies on a deep auto-encoder model to highlight anomalies and their context. To implicate security analysts and benefit from their expertise, we focus on limiting the need of data science knowledge during the configuration phase. Results on a lab environment, monitored using off-the-shelf tools, show good detection performances on several attack scenarios (F1 score ≈ 0.9), and eases the investigation of anomalies by quickly finding similar anomalies through clustering.
Fichier principal
Vignette du fichier
main.pdf (2.83 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04181626 , version 1 (16-08-2023)

Identifiants

Citer

Alexandre Dey, Eric Totel, Benjamin Costé. DAEMON: dynamic auto-encoders for contextualised anomaly detection applied to security monitoring. 37th IFIP TC 11 International Conference, SEC 2022,, Jun 2022, Copenhagen, Denmark. ⟨10.1007/978-3-031-06975-8_4⟩. ⟨hal-04181626⟩
18 Consultations
28 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More