nach oben

Erschienen in:

2023 | OriginalPaper | Buchkapitel

Multilayer Block Models for Exploratory Analysis of Computer Event Logs

verfasst von : Corentin Larroche

Erschienen in: Complex Networks and Their Applications XI

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

We investigate a graph-based approach to exploratory data analysis in the context of network security monitoring. Given a possibly large batch of event logs describing ongoing activity, we first represent these events as a bipartite multiplex graph. We then apply a model-based biclustering algorithm to extract relevant clusters of entities and interactions between these clusters, thereby providing a simplified situational picture. We illustrate this methodology through two case studies addressing network flow records and authentication logs, respectively. In both cases, the inferred clusters reveal the functional roles of entities as well as relevant behavioral patterns. Displaying interactions between these clusters also helps uncover malicious activity. Our code is available at https://github.com/cl-anssi/MultilayerBlockModels.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Structural Cores and Problems of Vulnerability of Partially Overlapped Multilayer Networks

Nächstes Kapitel On the Effectiveness of Using Link Weights and Link Direction for Community Detection in Multilayer Networks

TCP/20 (FTP-Data), TCP/21 (FTP), TCP/22 (SSH), TCP/23 (Telnet), TCP/25 (SMTP), TCP/53 (DNS), TCP/80 (HTTP), TCP/443 (HTTPS), TCP/465 (SMTPS), and TCP/587 (SMTP message submission).

Ball, R., Fink, G.A., North, C.: Home-centric visualization of network traffic for security administration. In: VizSec/DMSec (2004)

Barbillon, P., Donnet, S., Lazega, E., Bar-Hen, A.: Stochastic block models for multiplex networks: an application to a multilevel network of researchers. J. R. Stat. Soc. A Stat. 180(1), 295–314 (2017)MathSciNetCrossRef

Biernacki, C., Celeux, G., Govaert, G.: Assessing a mixture model for clustering with the integrated completed likelihood. IEEE Trans. Pattern Anal. Mach. Intell. 22(7), 719–725 (2000)CrossRef

Côme, E., Latouche, P.: Model selection and clustering in stochastic block models based on the exact integrated complete data likelihood. Stat. Model. 15(6), 564–589 (2015)MathSciNetCrossRefMATH

Corneli, M., Latouche, P., Rossi, F.: Exact ICL maximization in a non-stationary time extension of the latent block model for dynamic networks. In: ESANN (2015)

De Bacco, C., Power, E.A., Larremore, D.B., Moore, C.: Community detection, link prediction, and layer interdependence in multilayer networks. Phys. Rev. E 95(4), 042317 (2017)CrossRef

Dhillon, I.S.: Co-clustering documents and words using bipartite spectral graph partitioning. In: KDD (2001)

Fischer, F., Mansmann, F., Keim, D.A., Pietzko, S., Waldvogel, M.: Large-scale network monitoring for visual analysis of attacks. In: VizSec (2008)

Glatz, E., Mavromatidis, S., Ager, B., Dimitropoulos, X.: Visualizing big network traffic data using frequent pattern mining and hypergraphs. Computing 96(1), 27–38 (2014)CrossRef

10.

Govaert, G., Nadif, M.: Clustering with block mixture models. Pattern Recognit. 36(2), 463–473 (2003)CrossRefMATH

11.

Govaert, G., Nadif, M.: Block clustering with Bernoulli mixture models: comparison of different approaches. Comput. Stat. Data Anal. 52(6), 3233–3245 (2008)MathSciNetCrossRefMATH

12.

Govaert, G., Nadif, M.: Latent block model for contingency table. Commun. Stat. Theory Methods 39(3), 416–425 (2010)MathSciNetCrossRefMATH

13.

Hartigan, J.A.: Direct clustering of a data matrix. J. Am. Stat. Assoc. 67(337), 123–129 (1972)CrossRef

14.

Kent, A.D.: Comprehensive, multi-source cyber-security events. Los Alamos National Laboratory (2015)

15.

Kent, A.D.: Cybersecurity data sources for dynamic network research. In: Dynamic Networks in Cybersecurity. Imperial College Press (2015)

16.

Keribin, C., Brault, V., Celeux, G., Govaert, G.: Estimation and selection for the latent block model on categorical data. Stat. Comput. 25(6), 1201–1216 (2015)MathSciNetCrossRefMATH

17.

Kivelä, M., Arenas, A., Barthelemy, M., Gleeson, J.P., Moreno, Y., Porter, M.A.: Multilayer networks J. Complex Netw. 2(3), 203–271 (2014)

18.

Kluger, Y., Basri, R., Chang, J.T., Gerstein, M.: Spectral biclustering of microarray data: coclustering genes and conditions. Genome Res. 13(4), 703–716 (2003)CrossRef

19.

Lomet, A., Govaert, G., Grandvalet, Y.: Model selection in block clustering by the integrated classification likelihood. In: COMPSTAT (2012)

20.

Metelli, S., Heard, N.: On Bayesian new edge prediction and anomaly detection in computer networks. Ann. Appl. Stat. 13(4), 2586–2610 (2019)MathSciNetCrossRefMATH

21.

Paul, S., Chen, Y.: Consistent community detection in multi-relational data through restricted multi-layer stochastic blockmodel. Electron. J. Stat. 10(2), 3807–3870 (2016)MathSciNetCrossRefMATH

22.

Peixoto, T.P.: Inferring the mesoscale structure of layered, edge-valued, and time-varying networks. Phys. Rev. E 92(4), 042807 (2015)CrossRef

23.

Siadati, H., Saket, B., Memon, N.: Detecting malicious logins in enterprise networks using visualization. In: VizSec (2016)

24.

Stanley, N., Shai, S., Taylor, D., Mucha, P.J.: Clustering network layers with the strata multilayer stochastic block model. IEEE Trans. Netw. Sci. Eng. 3(2), 95–105 (2016)MathSciNetCrossRef

25.

Taylor, T., Paterson, D., Glanfield, J., Gates, C., Brooks, S., McHugh, J.: Flovis: Flow visualization system. In: CATCH (2009)

26.

Whiting, M., Cook, K., Paul, C., Whitley, K., Grinstein, G., Nebesh, B., Liggett, K., Cooper, M., Fallon, J.: Vast challenge 2013: Situation awareness and prospective analysis. In: VAST (2013)

27.

Wyse, J., Friel, N., Latouche, P.: Inferring structure in bipartite networks using the latent blockmodel and exact ICL. Netw. Sci. 5(1), 45–69 (2017)CrossRef

28.

Yin, X., Yurcik, W., Treaster, M., Li, Y., Lakkaraju, K.: Visflowconnect: netflow visualizations of link relationships for security situational awareness. In: VizSec/DMSec (2004)

Titel: Multilayer Block Models for Exploratory Analysis of Computer Event Logs
verfasst von: Corentin Larroche
Verlag: Springer International Publishing
Buch: Complex Networks and Their Applications XI
Print ISBN: 978-3-031-21126-3

Electronic ISBN: 978-3-031-21127-0

Copyright-Jahr: 2023
DOI: https://doi.org/10.1007/978-3-031-21127-0_51

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Premium Partner