论文标题
多层块模型用于计算机事件日志的探索性分析
Multilayer Block Models for Exploratory Analysis of Computer Event Logs
论文作者
论文摘要
我们在网络安全监控的背景下研究了一种基于图的探索性数据分析的方法。给定可能大量的事件日志描述了正在进行的活动，我们首先将这些事件表示为两部分多路复用图。然后，我们将基于模型的双簇算法应用于这些群集之间的实体和相互作用的相关簇，从而提供了简化的情境图片。我们通过两个案例研究分别解决了网络流记录和身份验证日志，从而说明了这种方法。在这两种情况下，推断的簇揭示了实体和相关行为模式的功能作用。在这些簇之间显示相互作用也有助于发现恶意活动。我们的代码可从https://github.com/cl-anssi/multilayerblockmodels获得。
We investigate a graph-based approach to exploratory data analysis in the context of network security monitoring. Given a possibly large batch of event logs describing ongoing activity, we first represent these events as a bipartite multiplex graph. We then apply a model-based biclustering algorithm to extract relevant clusters of entities and interactions between these clusters, thereby providing a simplified situational picture. We illustrate this methodology through two case studies addressing network flow records and authentication logs, respectively. In both cases, the inferred clusters reveal the functional roles of entities as well as relevant behavioral patterns. Displaying interactions between these clusters also helps uncover malicious activity. Our code is available at https://github.com/cl-anssi/MultilayerBlockModels.
