Search:
Computing and Library Services - delivering an inspiring information environment

GraphBAD: A General Technique for Anomaly Detection in Security Information and Event Management

Parkinson, Simon, Vallati, Mauro, Crampton, Andrew and Sohrabi, Shirin (2018) GraphBAD: A General Technique for Anomaly Detection in Security Information and Event Management. Concurrency and Computation: Practice and Experience. ISSN 1532-0626

[img] PDF - Accepted Version
Restricted to Repository staff only until 28 January 2019.

Download (659kB)

Abstract

The reliance on expert knowledge—required for analysing security logs and performing security audits—has created an unhealthy balance, where many computer users are not able to correctly audit their security configurations and react to potential security threats. The decreasing cost of IT and the increasing use of technology in domestic life are exacerbating this problem, where small companies and home IT users are not able to afford the price of experts for auditing their system configuration. In this paper, we present GraphBAD, a graph-based analysis tool that is able to analyse security configurations in order to identify anomalies that could lead to potential security risks. GraphBAD, which does not require any prior domain knowledge, generates graph-based models from security configuration data and, by analysing such models, is able to propose mitigation plans that can help computer users in increasing the security of their systems. A large experimental analysis, conducted on both publicly available (the well-known KDD dataset) and synthetically generated testing sets (file system permissions), demonstrates the ability of GraphBAD in correctly identifying security configuration anomalies and suggesting appropriate mitigation plans.

Item Type: Article
Additional Information: "This is the peer reviewed version of the following article: Parkinson S, Vallati M, Crampton A, Sohrabi S. GraphBAD: A general technique for anomaly detection in security information and event management. Concurrency Computat Pract Exper. 2018;e4433., which has been published in final form at https://doi.org/10.1002/cpe.4433. This article may be used for non-commercial purposes in accordance with Wiley Terms and Conditions for Self-Archiving."
Uncontrolled Keywords: Security Auditing, Log Files, Graph Structure, Anomaly Detection, SIEM
Subjects: Q Science > QA Mathematics > QA76 Computer software
Schools: School of Computing and Engineering
Related URLs:
Depositing User: Sally Hughes
Date Deposited: 03 Jan 2018 11:53
Last Modified: 26 Mar 2018 14:47
URI: http://eprints.hud.ac.uk/id/eprint/34133

Downloads

Downloads per month over past year

Repository Staff Only: item control page

View Item View Item

University of Huddersfield, Queensgate, Huddersfield, HD1 3DH Copyright and Disclaimer All rights reserved ©