Abstract:Intrusion detection system (IDS) is an important part of enterprise security system architecture. In particular, anomaly-based IDS has been widely applied to detect abnormal process behaviors that deviate from the majority. However, such abnormal behavior usually consists of a series of low-level heterogeneous events. The gap between the low-level events and the high-level abnormal behaviors makes it hard to infer which single events are related to the real abnormal activities, especially considering that there are massive "noisy" low-level events happening in between. Hence, the existing work that focus on detecting single entities/events can hardly achieve high detection accuracy. Different from previous work, we design and implement GID, an efficient graph-based intrusion detection technique that can identify abnormal event sequences from a massive heterogeneous process traces with high accuracy. GID first builds a compact graph structure to capture the interactions between different system entities. The suspiciousness or anomaly score of process paths is then measured by leveraging random walk technique to the constructed acyclic directed graph. To eliminate the score bias from the path length, the Box-Cox power transformation based approach is introduced to normalize the anomaly scores so that the scores of paths of different lengths have the same distribution. The efficiency of suspicious path discovery is further improved by the proposed optimization scheme. We fully implement our GID algorithm and deploy it into a real enterprise security system, and it greatly helps detect the advanced threats, and optimize the incident response. Executing GID on system monitoring datasets showing that GID is efficient (about 2 million records per minute) and accurate (higher than 80% in terms of detection rate).

Supporting a real-time distributed intrusion detection application on GATES

Intrusion Detection And Simulation For High-Speed Networks

Research on Data Mining-based Intrusion Detection in Real-time Environment

Grid computing oriented on-demand intrusion detection model

A New Flexible Multi-Agent Approach To Intrusion Detection For Grid

Distributed Attack Detection of Multi-area Power Systems Against False Data Injection Attacks

Group Testing Based Detection of Web Service DDoS Attackers.

Mobility and Intruder Prior Information Improving the Barrier Coverage of Sparse Sensor Networks

Artificial Immune System Based Intrusion Detection In A Distributed Hierarchical Network Architecture Of Smart Grid

A distributed platform for intrusion detection system using data stream mining in a big data environment

GID: Graph-based Intrusion Detection on Massive Process Traces for Enterprise Security Systems

Distributed Intrusion Detection System in a Multi-Layer Network Architecture of Smart Grids

Smart city infrastructure protection: real-time threat detection employing online reservoir computing architecture

Midas: Microcluster-Based Detector of Anomalies in Edge Streams

Big data analysis and distributed deep learning for next-generation intrusion detection system optimization

A Game-Based Intrusion Tolerant Mechanism for Grid Service

Adaptive Distributed Intrusion Detection Using Parametric Model

A Distributed and Autonomous Guard System Based on Cloud Environments

Distributed Data-Driven Intrusion Detection for Sparse Stealthy FDI Attacks in Smart Grids

A distributed ensemble design based intrusion detection system using fog computing to protect the internet of things networks

Advanced Persistent Threat Detection in Smart Grid Clouds Using Spatiotemporal Context-Aware Graph Embedding