Abstract:Intrusion detection systems (IDSs) generate valuable knowledge about network security, but an abundance of false alarms and a lack of methods to capture the interdependence among alerts hampers their utility for network defense. Here, we explore a graph-based approach for fusing alerts generated by multiple IDSs (e.g., Snort, OSSEC, and Bro). Our approach generates a weighted graph of alert fields (not network topology) that makes explicit the connections between multiple alerts, IDS systems, and other cyber artifacts. We use this multi-modal graph to identify anomalous changes in the alert patterns of a network. To detect the anomalies, we apply the role-dynamics approach, which has successfully identified anomalies in social media, email, and IP communication graphs. In the cyber domain, each node (alert field) in the fused IDS alert graph is assigned a probability distribution across a small set of roles based on that node's features. A cyber attack should trigger IDS alerts and cause changes in the node features, but rather than track every feature for every alert-field node individually, roles provide a succinct, integrated summary of those feature changes. We measure changes in each node's probabilistic role assignment over time, and identify anomalies as deviations from expected roles. We test our approach using simulations including three weeks of normal background traffic, as well as cyber attacks that occur near the end of the simulations. This paper presents a novel approach to multi-modal data fusion and a novel application of role dynamics within the cyber-security domain. Our results show a drastic decrease in the false-positive rate when considering our anomaly indicator instead of the IDS alerts themselves, thereby reducing alarm fatigue and providing a promising avenue for threat intelligence in network defense.

Anomaly detection on bipartite graphs for cyber situational awareness and threat detection

ASA: Adversary Situation Awareness Via Heterogeneous Graph Convolutional Networks.

Anomaly detection by discovering bipartite structure on complex networks

Cyber Anomaly Detection Using Graph-node Role-dynamics

An Unsupervised Spatiotemporal Graphical Modeling Approach to Anomaly Detection in Distributed CPS

Directional Laplacian Centrality for Cyber Situational Awareness

Anomaly Detection in Cyber Security with Graph-Based LSTM in Log Analysis

A Survey of Graph-based Deep Learning for Anomaly Detection in Distributed Systems

Multi-representations Space Separation based Graph-level Anomaly-aware Detection

Anomaly Detection in Graph Structured Data: A Survey

Anonymous Edge Representation for Inductive Anomaly Detection in Dynamic Bipartite Graph

A Hybrid Approach Of Http Anomaly Detection

LogSHIELD: A Graph-based Real-time Anomaly Detection Framework using Frequency Analysis

Wrongdoing Monitor: A Graph-Based Behavioral Anomaly Detection in Cyber Security

DPDGAD: A Dual-Process Dynamic Graph-based Anomaly Detection for multivariate time series analysis in cyber-physical systems

DAGAD: Data Augmentation for Graph Anomaly Detection

Anomaly Detection and Correction in Large Labeled Bipartite Graphs

Learning Spatial Graph Structure for Multivariate KPI Anomaly Detection in Large-Scale Cyber-Physical Systems.

Data-Driven Network Anomaly Detection with Cyber Attack and Defense Visualization

An Anomaly Detection Method Based on Meta-Path and Heterogeneous Graph Attention Network

An Efficient BGP Anomaly Detection Scheme with Hybrid Graph Features