SIERRA：对企业网中的异常活动进行分级
SIERRA: Ranking Anomalous Activities in Enterprise Networks
摘要：
如今，企业在其网络中部署了多个安全中间盒，如防火墙、IDS、IPS等，以收集与威胁和攻击相关的不同类型的事件。这些事件被传输到SIEM（安全信息和事件管理）系统中，供分析人员进行调查，并通过适当的行动迅速做出响应。然而，为单个企业收集的事件数量每天可以轻松达到数十万，远远超过分析师在给定预算限制（时间）下可以调查的数量。在这项工作中，我们研究了对可疑事件或异常进行优先级排序的问题，以供分析师进一步调查。我们开发了SIERRA，一个处理来自多个不同中间盒的事件日志以检测和排名异常活动的系统。SIERRA采用无监督方法，因此不依赖于地面实况数据。与其他作品不同的是，SIERRA定义了上下文，这有助于它提供视觉解释的高排名的异常点的分析师，尽管采用无监督的模型。我们使用来自企业网的多个安全中间盒的数月日志来评估SIERRA。评估结果表明，SIERRA能够检测网络中的顶级异常，同时优于现有异常检测算法的朴素应用程序以及最先进的基于SIEM的异常检测解决方案。
英文摘要：
An enterprise today deploys multiple security middleboxes such as firewalls, IDS, IPS, etc. in its network to collect different kinds of events related to threats and attacks. These events are streamed into a SIEM (Security Information and Event Management) system for analysts to investigate and respond quickly with appropriate actions. However, the number of events collected for a single enterprise can easily run into hundreds of thousands per day, much more than what analysts can investigate under a given budget constraint (time). In this work, we look into the problem of prioritizing suspicious events or anomalies to analysts for further investigation. We develop SIERRA, a system that processes event logs from multiple and diverse middleboxes to detect and rank anomalous activities. SIERRA takes an unsupervised approach and therefore has no dependence on ground truth data. Different from other works, SIERRA defines contexts, that help it to provide visual explanations of highly-ranked anomalous points to analysts, despite employing unsupervised models. We evaluate SIERRA using months of logs from multiple security middleboxes of an enterprise network. The evaluations demonstrate the capability of SIERRA to detect top anomalies in a network while outperforming naive application of existing anomaly detection algorithms as well as a state-of-the-art SIEM-based anomaly detection solution.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
