SAQL：一个基于流的实时的异常系统行为检测查询系统
SAQL: A Stream-based Query System for Real-Time Abnormal System Behavior Detection
摘要：
最近，高级网络攻击包括一系列涉及许多漏洞和主机的步骤，危及许多受到良好保护的企业的安全。这导致了将每个主机（大数据）中的系统活动作为一系列事件无处不在地监视，并搜索异常（异常行为）以分类风险事件的解决方案。由于对抗这些攻击是一项时间紧迫的任务，以防止进一步的损害，这些解决方案面临的挑战是结合专业知识，对大规模来源数据进行及时的异常检测。为了解决这些挑战，我们提出了一种新的基于流的查询系统，作为输入，一个实时的【形】事件提要聚合从多个主机在企业，并提供了一个异常查询引擎，查询事件提要，以确定异常行为的基础上指定的异常。为了便于基于专家知识表达异常的任务，我们的系统提供了一个特定于域的查询语言，SAQL，它允许分析师表示模型（1）基于规则的异常，（2）时间序列异常，（3）基于不变量的异常，（4）基于异常。我们在NEC Labs America部署了由150台主机组成的系统，并使用1.1TB的真实系统监控数据（包含33亿个事件）对其进行了评估。我们对一系列攻击行为和微基准测试的评估表明，我们的系统具有低检测延迟（<2 s）和高系统吞吐量（110，000事件/s;支持~4000台主机），并且在内存利用率方面比现有的基于流的复杂事件处理系统更有效。
英文摘要：
Recently, advanced cyber attacks, which consist of a sequence of steps that involve many vulnerabilities and hosts, compromise the security of many well-protected businesses. This has led to the solutions that ubiquitously monitor system activities in each host (big data) as a series of events, and search for anomalies (abnormal behaviors) for triaging risky events. Since fighting against these attacks is a time-critical mission to prevent further damage, these solutions face challenges in incorporating expert knowledge to perform timely anomaly detection over the large-scale provenance data. To address these challenges, we propose a novel stream-based query system that takes as input, a real-time event feed aggregated from multiple hosts in an enterprise, and provides an anomaly query engine that queries the event feed to identify abnormal behaviors based on the specified anomalies. To facilitate the task of expressing anomalies based on expert knowledge, our system provides a domain-specific query language, SAQL, which allows analysts to express models for (1) rule-based anomalies, (2) time-series anomalies, (3) invariant-based anomalies, and (4) outlier-based anomalies. We deployed our system in NEC Labs America comprising 150 hosts and evaluated it using 1.1TB of real system monitoring data (containing 3.3 billion events). Our evaluations on a broad set of attack behaviors and micro-benchmarks show that our system has a low detection latency (<2s) and a high system throughput (110,000 events/s; supporting ~4000 hosts), and is more efficient in memory utilization than the existing stream-based complex event processing systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
