Authors:
Markus Goldstein
1
;
Stefan Asanger
2
;
Matthias Reif
1
and
Andrew Hutchison
3
Affiliations:
1
German Research Center for Artificial Intelligence (DFKI), Germany
;
2
University of Cape Town, South Africa
;
3
T-Systems International, South Africa
Keyword(s):
Anomaly Detection, Event Management, SIEM, Outlier Detection,Windows Events, User Profiling, Behavior Profiling, Behavioral Analysis.
Related
Ontology
Subjects/Areas/Topics:
Applications
;
Economics, Business and Forecasting Applications
;
Learning and Adaptive Control
;
Pattern Recognition
;
Ranking
;
Software Engineering
Abstract:
Security Information and Event Management (SIEM) systems are today a key component of complex enterprise networks. They usually aggregate and correlate events from different machines and perform a rule-based analysis to detect threats. In this paper we present an enhancement of such systems which makes use of unsupervised anomaly detection algorithms without the need for any prior training of the system. For data acquisition, events are exported from an existing SIEM appliance, parsed, unified and preprocessed to fit the requirements of unsupervised anomaly detection algorithms. Six different algorithms are evaluated qualitatively and finally a global k-NN approach was selected for a practical deployment. The new system was able to detect misconfigurations and gave the security operation center team more insight about processes in the network.