Search:
Computing and Library Services - delivering an inspiring information environment

GraphBAD: A General Technique for Anomaly Detection in Security Information and Event Management

Parkinson, Simon, Vallati, Mauro, Crampton, Andrew and Sohrabi, Shirin (2018) GraphBAD: A General Technique for Anomaly Detection in Security Information and Event Management. Concurrency and Computation: Practice and Experience. ISSN 1532-0626 (In Press)

[img] PDF - Accepted Version
Restricted to Repository staff only

Download (659kB)

Abstract

The reliance on expert knowledge –required for analysing security logs and performing
security audits– has created an unhealthy balance where many computer
users are not able to correctly audit their security configurations and react to potential
security threats. The decreasing cost of IT and the increasing use of technology
in domestic life is exacerbating this problem where small companies and home IT
users are not able to afford the price of experts for auditing their systems configuration.
In this paper we present GraphBAD, a graph-based analysis tool able to analyse
security configurations in order to identify anomalies that could lead to potential
security risks. GraphBAD, which does not require any prior domain knowledge,
generates graph-based models from security configuration data and, by analysing
such models, is able to propose mitigation plans that can help computer users in
increasing the security of their systems. A large experimental analysis, conducted on
both publicly available (the well-known KDD dataset) and synthetically generated
testing sets (file system permissions), demonstrates the ability of GraphBAD in
correctly identifying security configurations anomalies and suggesting appropriate
mitigation plans.

Item Type: Article
Uncontrolled Keywords: Security Auditing, Log Files, Graph Structure, Anomaly Detection, SIEM
Subjects: Q Science > QA Mathematics > QA76 Computer software
Schools: School of Computing and Engineering
Related URLs:
Depositing User: Sally Hughes
Date Deposited: 03 Jan 2018 11:53
Last Modified: 03 Jan 2018 11:54
URI: http://eprints.hud.ac.uk/id/eprint/34133

Downloads

Downloads per month over past year

Repository Staff Only: item control page

View Item View Item

University of Huddersfield, Queensgate, Huddersfield, HD1 3DH Copyright and Disclaimer All rights reserved ©