1. On the Feasibility of Anomaly Detection with Fine-Grained Program Tracing Events.
- Author
-
Li, Hong-Wei, Wu, Yu-Sung, and Huang, Yennun
- Subjects
- *
SEQUENTIAL pattern mining - Abstract
The efficacy of anomaly detection is fundamentally limited by the descriptive power of the input events. Today's anomaly detection systems are optimized for coarse-grained events of specific types such as system logs and API traces. An attack can evade detection by avoiding noticeable manifestations in the coarse-grained events. Intuitively, we may fix the loopholes by reducing the event granularity, but this brings up two obvious challenges. First, fine-grained events may not have the rich semantics needed for feature construction. Second, the anomaly detection algorithms may not scale for the volume of the fine-grained events. We propose the application profile extractor (APE) that utilizes compression-based sequential pattern mining to generate compact profiles from fine-grained program traces for anomaly detection algorithms. With minimal assumptions on the event semantics, the profile generation are compatible with a wide variety of program traces. In addition, the compact profiles scale anomaly detection algorithms for the high data rate of fine-grained program tracing. We also outline scenarios that justify the need for anomaly detection with fine-grained program tracing events. [ABSTRACT FROM AUTHOR]
- Published
- 2022
- Full Text
- View/download PDF