论文标题
基于宿主的日志中异常检测的拓扑数据分析
Topological Data Analysis for Anomaly Detection in Host-Based Logs
论文作者
论文摘要
拓扑数据分析（TDA）使执业者能够分析网络安全数据的全局结构。我们将TDA用于使用开源日志记录（LME）项目收集的基于主机的日志中的异常检测。我们提出了一种方法，该方法直接从Windows日志中构建了简单复合物的过滤，从而可以使用拓扑工具对其内在结构进行分析。我们将持续的同源性和图形和超毛图拉普拉克斯作为特征向量的频谱与计算事件的标准日志嵌入的功效进行了比较，并发现计算机对数的拓扑和光谱嵌入包含歧视性信息，这些信息包含用于对标准嵌入符合标准嵌入的异常日志进行分类的歧视性信息。最后，我们讨论了将我们的方法用作可解释的异常检测框架的一部分的潜力。
Topological Data Analysis (TDA) gives practioners the ability to analyse the global structure of cybersecurity data. We use TDA for anomaly detection in host-based logs collected with the open-source Logging Made Easy (LME) project. We present an approach that builds a filtration of simplicial complexes directly from Windows logs, enabling analysis of their intrinsic structure using topological tools. We compare the efficacy of persistent homology and the spectrum of graph and hypergraph Laplacians as feature vectors against a standard log embedding that counts events, and find that topological and spectral embeddings of computer logs contain discriminative information for classifying anomalous logs that is complementary to standard embeddings. We end by discussing the potential for our methods to be used as part of an explainable framework for anomaly detection.
