DANTE：在系统日志上使用LSTM预测内部威胁
DANTE: Predicting Insider Threat using LSTM on system logs
摘要：
内部威胁是世界各地信息和通信技术（ICT）最有害的威胁载体之一，因为内部人员的信任和访问程度提高。这种类型的威胁可能来自有动机的恶意用户以及疏忽的用户，他们无意中泄露了有关商业机密、公司信息的详细信息，甚至向恶意玩家访问信息。在本文中，我们提出了一种新的方法，使用系统日志来检测内部行为使用一个特殊的递归神经网络（RNN）模型。使用DANTE建立地面实况，并将其用作识别异常行为的基线。为此，系统日志被建模为一个自然语言序列，并从这些序列中提取模式。我们创建遵循自然语言逻辑和控制流的动作序列的工作流。这些流被分配了各种行为类别-恶性或良性。任何与这些序列的偏差都表明存在威胁。我们进一步将威胁分类为CERT内部威胁数据集中提供的五个类别之一。通过实验评估，我们表明，该模型可以达到99%的预测精度。
英文摘要：
Insider threat is one of the most pernicious threat vectors to information and communication technologies (ICT)across the world due to the elevated level of trust and access that an insider is afforded. This type of threat can stem from both malicious users with a motive as well as negligent users who inadvertently reveal details about trade secrets, company information, or even access information to malignant players. In this paper, we propose a novel approach that uses system logs to detect insider behavior using a special recurrent neural network (RNN) model. Ground truth is established using DANTE and used as the baseline for identifying anomalous behavior. For this, system logs are modeled as a natural language sequence and patterns are extracted from these sequences. We create workflows of sequences of actions that follow a natural language logic and control flow. These flows are assigned various categories of behaviors - malignant or benign. Any deviation from these sequences indicates the presence of a threat. We further classify threats into one of the five categories provided in the CERT insider threat dataset. Through experimental evaluation, we show that the proposed model can achieve 99% prediction accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
