Anomaly Detection in Log Data using Graph Databases and Machine Learning to Defend Advanced Persistent Threats
Author:
Abstract
Advanced Persistent Threats (APTs) are a main impendence in cyber security of computer networks. In 2015, a successful breach remains undetected 146 days on average, reported by [Fi16].With our work we demonstrate a feasible and fast way to analyse real world log data to detect breaches or breach attempts. By adapting well-known kill chain mechanisms and a combine of a time series database and an abstracted graph approach, it is possible to create flexible attack profiles. Using this approach, it can be demonstrated that the graph analysis successfully detects simulated attacks by analysing the log data of a simulated computer network. Considering another source for log data, the framework is capable to deliver sufficient performance for analysing real-world data in short time. By using the computing power of the graph database it is possible to identify the attacker and furthermore it is feasible to detect other affected system components. We believe to significantly reduce the detection time of breaches with this approach and react fast to new attack vectors.
- Citation
- BibTeX
Schindler, T.,
(2017).
Anomaly Detection in Log Data using Graph Databases and Machine Learning to Defend Advanced Persistent Threats.
In:
Eibl, M. & Gaedke, M.
(Hrsg.),
INFORMATIK 2017.
Gesellschaft für Informatik, Bonn.
(S. 2371-2378).
DOI: 10.18420/in2017_241
@inproceedings{mci/Schindler2017,
author = {Schindler, Timo},
title = {Anomaly Detection in Log Data using Graph Databases and Machine Learning to Defend Advanced Persistent Threats},
booktitle = {INFORMATIK 2017},
year = {2017},
editor = {Eibl, Maximilian AND Gaedke, Martin} ,
pages = { 2371-2378 } ,
doi = { 10.18420/in2017_241 },
publisher = {Gesellschaft für Informatik, Bonn},
address = {}
}
author = {Schindler, Timo},
title = {Anomaly Detection in Log Data using Graph Databases and Machine Learning to Defend Advanced Persistent Threats},
booktitle = {INFORMATIK 2017},
year = {2017},
editor = {Eibl, Maximilian AND Gaedke, Martin} ,
pages = { 2371-2378 } ,
doi = { 10.18420/in2017_241 },
publisher = {Gesellschaft für Informatik, Bonn},
address = {}
}
Sollte hier kein Volltext (PDF) verlinkt sein, dann kann es sein, dass dieser aus verschiedenen Gruenden (z.B. Lizenzen oder Copyright) nur in einer anderen Digital Library verfuegbar ist. Versuchen Sie in diesem Fall einen Zugriff ueber die verlinkte DOI: 10.18420/in2017_241
Haben Sie fehlerhafte Angaben entdeckt? Sagen Sie uns Bescheid: Send Feedback
More Info
DOI: 10.18420/in2017_241
ISBN: 978-3-88579-669-5
ISSN: 1617-5468
xmlui.MetaDataDisplay.field.date: 2017
Language:
(en)

Keywords
Collections
- P275 - INFORMATIK 2017 [266]