Exploratory security analytics for anomaly detection

The huge number of alerts generated by network-based defense systems prevents detailed manual inspections of security events. Existing proposals for automatic alerts analysis work well in relatively stable and homogeneous environments, but in modern networks, that are characterized by extremely comp...

Full description

Saved in:
Bibliographic Details
Published in:Computers & security 2016-02, Vol.56, p.28-49
Main Authors: Pierazzi, Fabio, Casolari, Sara, Colajanni, Michele, Marchetti, Mirco
Format: Article
Language:English
Subjects:
Anomaly detection
Data analysis
Effectiveness studies
Feature extraction
Network alerts
Network security
Security analytics
Security management
Temporal characterization
Time series analysis
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The huge number of alerts generated by network-based defense systems prevents detailed manual inspections of security events. Existing proposals for automatic alerts analysis work well in relatively stable and homogeneous environments, but in modern networks, that are characterized by extremely complex and dynamic behaviors, understanding which approaches can be effective requires exploratory data analysis and descriptive modeling. We propose a novel framework for automatically investigating temporal trends and patterns of security alerts with the goal of understanding whether and which anomaly detection approaches can be adopted for identifying relevant security events. Several examples referring to a real large network show that, despite the high intrinsic dynamism of the system, the proposed framework is able to extract relevant descriptive statistics that allow to determine the effectiveness of popular anomaly detection approaches on different alerts groups.
ISSN:0167-4048
1872-6208
DOI:10.1016/j.cose.2015.10.003