2021/03/29 by Corentin Larroche, Larroche, Corentin, Johan Mazel +3
Computer Science · Physics and Astronomy · #Anomaly Detection Techniques and Applications #Complex Network Analysis Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection
paper · pdf · doi:10.48550/arxiv.2103.15708
openalex publication_date 2021/03/29 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Anomaly detection in event logs is a promising approach for intrusion detection in enterprise networks. By building a statistical model of usual activity, it aims to detect multiple kinds of malicious behavior, including stealthy tactics, techniques and procedures (TTPs) designed to evade signature-based detection systems. However, finding suitable anomaly detection methods for event logs remains an important challenge. This results from the very complex, multi-faceted nature of the data: event logs are not only combinatorial, but also temporal and heterogeneous data, thus they fit poorly in most theoretical frameworks for anomaly detection. Most previous research focuses on either one of these three aspects, building a simplified representation of the data that can be fed to standard anomaly detection algorithms. In contrast, we propose to simultaneously address all three of these characteristics through a specifically tailored statistical model. We introduce Decades, a \underlinedynamic, h\underlineeterogeneous and \underlinecombinatorial model for \underlineanomaly \underlinedetection in \underlineevent \underlinestreams, and we demonstrate its effectiveness at detecting malicious behavior through experiments on a real dataset containing labelled red team activity. In particular, we empirically highlight the importance of handling the multiple characteristics of the data by comparing our model with state-of-the-art baselines relying on various data representations.