Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 16

The DOI matches its Crossref record; 25 of the 25 references it cites were found in a registry or an index.

MADDC: Multi-Scale Anomaly Detection, Diagnosis and Correction for Discrete Event Logs

Wang, Xiaolei, Yang, Lin, Li, Dongyang, Ma, Linru, He, Yongzhong, Xiao, Junchao, Liu, Jiyuan, Yang, Yuexiang·2022·Proceedings of the 38th Annual Computer Security Applications Conference
DOI 10.1145/3564625.3567972
Open this paper in CoChat — free account

Abstract

Anomaly detection for discrete event logs can provide critical information for building secure and reliable systems in various application domains, such as large scale data centers, autonomous driving, and intrusion detection. However, the task is very challenging due to the lack of a clear understanding and definition of anomaly in the specific problem space, and the log data is often highly complex with temporal correlation. Existing deep learning based methods mostly suffer from such issues as overfitting, uncertainty or low interpretability; consequently, the detection results may be inaccurate, with little information to help security analysts diagnose the reported anomalies with high confidence. To tackle this challenge, in this research, we propose a general framework named MADDC, which aims to (1) accurately perform Multi-scale Anomaly Detection, Diagnosis and Correction for discrete event logs, and (2) help analysts further mitigate anomalies based on diagnosis results. Specifically, we first design a new anomaly critic for LSTM variational autoencoder based model to alleviate overfitting and reduce false negatives during anomaly detection. As one of our main contributions, we then introduce process mining technique to build process-centric workflow models in an unsupervised manner, which forms the ‘normal’ context of an event sequence and help perform accurate and consistent anomaly diagnosis through global sequence alignment. Experiments on publicly available datas…

Overview

Integrity signals

Registry

Crossref · 10.1145/3564625.3567972

Cites

25 of 25 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

This paper’s full text isn’t openly available, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Citations

Cites

Research works printed but not linked: 21

  1. W. Aalst , J. Carmona , T. Chatain , and B. V. Dongen . 2019 . A Tour in Process Mining: From Practice to Algorithmic Challenges. Trans. Petri Nets Other Model. Concurr. 14 (2019), 1 – 35 . W. Aalst, J. Carmona, T. Chatain, and B. V. Dongen. 2019. A Tour in Process Mining: From Practice to Algorithmic Challenges. Trans. Petri Nets Other Model. Concurr. 14 (2019), 1–35.
  2. W. Aalst and C. Günther . 2007 . Finding Structure in Unstructured Processes: The Case for Process Mining. Seventh International Conference on Application of Concurrency to System Design (ACSD 2007) ( 2007 ), 3–12. W. Aalst and C. Günther. 2007. Finding Structure in Unstructured Processes: The Case for Process Mining. Seventh International Conference on Application of Concurrency to System Design (ACSD 2007)(2007), 3–12.
  3. Abdulellah A. Alsaheel , Yuhong Nan , Shiqing Ma , Le Yu , Gregory Walkup , Z. Berkay Celik , X. Zhang , and Dongyan Xu . 2021 . ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium. Abdulellah A. Alsaheel, Yuhong Nan, Shiqing Ma, Le Yu, Gregory Walkup, Z. Berkay Celik, X. Zhang, and Dongyan Xu. 2021. ATLAS: A Sequence-based Learning Approach for Attack Investigation. In USENIX Security Symposium.
  4. A. Berti S. V. Zelst and W. Aalst. 2019. Process Mining for Python (PM4Py): Bridging the Gap Between Process- and Data Science. ArXiv abs/1905.06169(2019). A. Berti S. V. Zelst and W. Aalst. 2019. Process Mining for Python (PM4Py): Bridging the Gap Between Process- and Data Science. ArXiv abs/1905.06169(2019). · arXiv
  5. R. Bose and W. Aalst . 2010 . Trace Alignment in Process Mining: Opportunities for Process Diagnostics. In BPM. R. Bose and W. Aalst. 2010. Trace Alignment in Process Mining: Opportunities for Process Diagnostics. In BPM.
  6. Min Du and Feifei Li . 2016 . Spell: Streaming Parsing of System Event Logs. 2016 IEEE 16th International Conference on Data Mining (ICDM) (2016), 859–864. Min Du and Feifei Li. 2016. Spell: Streaming Parsing of System Event Logs. 2016 IEEE 16th International Conference on Data Mining (ICDM) (2016), 859–864.
  7. Shunan Guo , Zhuochen Jin , Q. Chen , D. Gotz , H. Zha , and N. Cao . 2019 . Visual Anomaly Detection in Event Sequence Data. 2019 IEEE International Conference on Big Data (Big Data) ( 2019 ), 1125–1130. Shunan Guo, Zhuochen Jin, Q. Chen, D. Gotz, H. Zha, and N. Cao. 2019. Visual Anomaly Detection in Event Sequence Data. 2019 IEEE International Conference on Big Data (Big Data) (2019), 1125–1130.
  8. Y. Guo Yujin Wen Congwei Jiang Yixin Lian and Yi Wan. 2021. Detecting Log Anomalies with Multi-Head Attention (LAMA). ArXiv abs/2101.02392(2021). Y. Guo Yujin Wen Congwei Jiang Yixin Lian and Yi Wan. 2021. Detecting Log Anomalies with Multi-Head Attention (LAMA). ArXiv abs/2101.02392(2021). · arXiv
  9. Xueyuan Han , Thomas Pasquier , Adam Bates , James W. Mickens , and Margo I. Seltzer . 2020 . UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. ArXiv abs/2001.01525(2020). Xueyuan Han, Thomas Pasquier, Adam Bates, James W. Mickens, and Margo I. Seltzer. 2020. UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats. ArXiv abs/2001.01525(2020). · arXiv
  10. Pinjia He , Jieming Zhu , Zibin Zheng , and Michael R. Lyu . 2017 . Drain: An Online Log Parsing Approach with Fixed Depth Tree. 2017 IEEE International Conference on Web Services (ICWS) (2017), 33–40. Pinjia He, Jieming Zhu, Zibin Zheng, and Michael R. Lyu. 2017. Drain: An Online Log Parsing Approach with Fixed Depth Tree. 2017 IEEE International Conference on Web Services (ICWS) (2017), 33–40.
  11. Diederik P. Kingma and M. Welling. 2014. Auto-Encoding Variational Bayes. CoRR abs/1312.6114(2014). Diederik P. Kingma and M. Welling. 2014. Auto-Encoding Variational Bayes. CoRR abs/1312.6114(2014). · arXiv
  12. Qingwei Lin , Hongyu Zhang , Jian-Guang Lou , Y. Zhang , and Xuewei Chen . 2016 . Log Clustering Based Problem Identification for Online Service Systems. 2016 IEEE/ACM 38th International Conference on Software Engineering Companion (ICSE-C) (2016), 102–111. Qingwei Lin, Hongyu Zhang, Jian-Guang Lou, Y. Zhang, and Xuewei Chen. 2016. Log Clustering Based Problem Identification for Online Service Systems. 2016 IEEE/ACM 38th International Conference on Software Engineering Companion (ICSE-C) (2016), 102–111.
  13. F. Liu , K. Ting , and Z. Zhou . 2008 . Isolation Forest. 2008 Eighth IEEE International Conference on Data Mining ( 2008 ), 413–422. F. Liu, K. Ting, and Z. Zhou. 2008. Isolation Forest. 2008 Eighth IEEE International Conference on Data Mining (2008), 413–422.
  14. Jian-Guang Lou , Qiang Fu , Shengqi Yang , Ye Xu , and Jiang Li . 2010 . Mining Invariants from Console Logs for System Problem Detection . In USENIX Annual Technical Conference. Jian-Guang Lou, Qiang Fu, Shengqi Yang, Ye Xu, and Jiang Li. 2010. Mining Invariants from Console Logs for System Problem Detection. In USENIX Annual Technical Conference.
  15. L. McInnes and John Healy . 2017 . Accelerated Hierarchical Density Based Clustering. 2017 IEEE International Conference on Data Mining Workshops (ICDMW) (2017), 33–42. L. McInnes and John Healy. 2017. Accelerated Hierarchical Density Based Clustering. 2017 IEEE International Conference on Data Mining Workshops (ICDMW) (2017), 33–42.
  16. Minseok Song , C. Günther , and W. Aalst . 2008 . Trace Clustering in Process Mining. In Business Process Management Workshops. Minseok Song, C. Günther, and W. Aalst. 2008. Trace Clustering in Process Mining. In Business Process Management Workshops.
  17. Yingbo Song , A. Keromytis , and S. Stolfo . 2009 . Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic. In NDSS. Yingbo Song, A. Keromytis, and S. Stolfo. 2009. Spectrogram: A Mixture-of-Markov-Chains Model for Anomaly Detection in Web Traffic. In NDSS.
  18. Aaron Tuor Samuel Kaplan Brian Hutchinson Nicole Nichols and Sean Robinson. 2017. Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams. ArXiv abs/1710.00811(2017). Aaron Tuor Samuel Kaplan Brian Hutchinson Nicole Nichols and Sean Robinson. 2017. Deep Learning for Unsupervised Insider Threat Detection in Structured Cybersecurity Data Streams. ArXiv abs/1710.00811(2017). · arXiv
  19. Z. Wang Zhengzhang Chen Jingchao Ni Hui Liu H. Chen and Jiliang Tang. 2020. Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection. ArXiv abs/2008.13361(2020). Z. Wang Zhengzhang Chen Jingchao Ni Hui Liu H. Chen and Jiliang Tang. 2020. Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection. ArXiv abs/2008.13361(2020). · arXiv
  20. 10.1109/ICDM.2009.19 · DOI
  21. Lun-Pin Yuan Euijin Choo Ting Yu Issa M. Khalil and Sencun Zhu. 2020. Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users. ArXiv abs/2012.13971(2020). Lun-Pin Yuan Euijin Choo Ting Yu Issa M. Khalil and Sencun Zhu. 2020. Time-Window Group-Correlation Support vs. Individual Features: A Detection of Abnormal Users. ArXiv abs/2012.13971(2020). · arXiv

Cited by

See all 16

Metadata

Authors
Wang, X., Yang, L., Li, D., Ma, L., He, Y., Xiao, J., Liu, J., & Yang, Y.
Affiliations
  • College of Computer, National University of Defense Technology, China
  • Systems Engineering Institute, Academy of Military Science, China
  • School of Computer and Information Technology, Beijing Jiaotong University, China
  • School of Systems Science and Engineering, Sun Yat-Sen University, China
ORCID
Venue
Proceedings of the 38th Annual Computer Security Applications Conference
Publisher
ACM
Published
2022-12-05
Pages
769-784
DOI
10.1145/3564625.3567972
Cited by
16
References
25
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.