Abstract:
User-group or asset-group information in an enterprise network plays important roles in the detection of behavioral anomalies, particularly in peer-based analysis. While ...Show MoreMetadata
Abstract:
User-group or asset-group information in an enterprise network plays important roles in the detection of behavioral anomalies, particularly in peer-based analysis. While user peer group data is readily available, since it is maintained by enterprise IT for network security policy administration, asset peer group data is typically nonexistent. Therefore, a method to automatically create asset groups or clusters is desired. This is useful both in building the asset taxonomy for knowledge discovery and in asset-peer analysis for anomaly detection. This work presents a behavior-based, asset-clustering method by analyzing data from user-to-asset logon event records while leveraging the existing user peer group labels. Output asset clusters are stable, with interpretable cluster labels for operational consideration. We demonstrate the value of the derived asset clusters in peer analysis for anomaly detection.
Date of Conference: 10-13 December 2018
Date Added to IEEE Xplore: 24 January 2019
ISBN Information: