Pikachu: Temporal Walk Based Dynamic Graph Embedding for Network Anomaly Detection
Pikachu: Temporal Walk Based Dynamic Graph Embedding for Network Anomaly Detection
复制标题
DOI：
10.1109/noms54207.2022.9789921
复制
发表时间：
2022-04
期刊：
影响因子：
--
通讯作者：
Ramesh Paudel;Huimin Huang
中科院分区：
文献类型：
--
作者：
Ramesh Paudel;Huimin Huang
企业网络随着时间的推移不断发展。除了网络拓扑之外，信息流的顺序对于检测不断发展的网络中的网络威胁也至关重要。大多数现有技术使用静态快照来从动态网络中学习。然而，使用静态快照是不够的，因为它在很大程度上忽略了高度粒度的时间信息，并由于聚合粒度的近似而导致信息丢失。在这项工作中，我们提出了 PIKACHU，一种复杂的、无监督的、基于时间行走的动态网络嵌入技术，可以捕获网络拓扑以及高度粒度的时间信息。皮卡丘通过保留节点的时间顺序来学习适当且有意义的表示。这是检测高级持续威胁 (APT) 的重要信息，因为时间顺序有助于了解攻击者的横向移动。在两个开源数据集 LANL 和 OpTC 数据集上进行的实验证明了检测网络异常的有效性。 PIKACHU 在 LANL 中实现了 95.1% 的真阳性率 (TPR)，在 OpTC 数据集上实现了 98.7% 的真阳性率 (TPR)。此外，在 LANL 数据集中，尽管 ROC 曲线下面积 (AUC) 相似，但假阳性率 (FPR) 降低了 4.65%。在 OpTC 数据集中，与其他最先进的方法相比，AUC 提高了 16%。
Enterprise networks evolve constantly over time. In addition to the network topology, the order of information flow is crucial to detect cyber-threats in a constantly evolving network. Majority of the existing technique uses static snapshot to learn from dynamic network. However, using static snapshots is not sufficient as it largely ignores highly granular temporal information and leads to information loss due to approximation of aggregation granularity. In this work, we propose PIKACHU, a sophisticated, unsupervised, temporal walk-based dynamic network embedding technique that can capture both network topology as well as highly granular temporal information. PIKACHU learns the appropriate and meaningful representation by preserving the temporal order of nodes. This is important information to detect Advanced Persistent Threat (APT) as temporal order helps to understand the lateral movement of the attacker. Experiments on two open-source datasets: LANL and OpTC datasets demonstrated the effectiveness in detecting network anomalies. PIKACHU achieves True Positive Rate (TPR) of 95.1% in LANL and 98.7% on OpTC dataset. Furthermore, in the LANL dataset, it achieves a 4.65% reduction in False Positive Rate (FPR) despite similar area under ROC curve (AUC). In the OpTC dataset 16% improvement in AUC was obtained in comparison to the other state-of-the-art approaches.