Generating Interpretable Network Asset Clusters For Security Analytics | IEEE Conference Publication | IEEE Xplore

Generating Interpretable Network Asset Clusters For Security Analytics


Abstract:

User-group or asset-group information in an enterprise network plays important roles in the detection of behavioral anomalies, particularly in peer-based analysis. While ...Show More

Abstract:

User-group or asset-group information in an enterprise network plays important roles in the detection of behavioral anomalies, particularly in peer-based analysis. While user peer group data is readily available, since it is maintained by enterprise IT for network security policy administration, asset peer group data is typically nonexistent. Therefore, a method to automatically create asset groups or clusters is desired. This is useful both in building the asset taxonomy for knowledge discovery and in asset-peer analysis for anomaly detection. This work presents a behavior-based, asset-clustering method by analyzing data from user-to-asset logon event records while leveraging the existing user peer group labels. Output asset clusters are stable, with interpretable cluster labels for operational consideration. We demonstrate the value of the derived asset clusters in peer analysis for anomaly detection.
Date of Conference: 10-13 December 2018
Date Added to IEEE Xplore: 24 January 2019
ISBN Information:
Conference Location: Seattle, WA, USA

Contact IEEE to Subscribe

References

References is not available for this document.