Behavior Query Discovery in System-Generated Temporal Graphs
Bo Zong, Xusheng Xiao, Zhichun Li, Zhenyu Wu, Zhiyun Qian, Xifeng Yan,, Ambuj K. Singh, Guofei Jiang

TL;DR
This paper presents TGMiner, a method for efficiently mining discriminative temporal graph patterns from system logs to facilitate query formulation, enabling better detection of system anomalies and malicious activities.
Contribution
Introduces TGMiner, a novel temporal graph pattern mining approach that improves query discovery in system logs by leveraging temporal information for pruning.
Findings
TGMiner is 6-32 times faster than baseline methods.
Discovered patterns achieved 97% precision and 91% recall.
Patterns help system experts identify abnormal activities effectively.
Abstract
Computer system monitoring generates huge amounts of logs that record the interaction of system entities. How to query such data to better understand system behaviors and identify potential system risks and malicious behaviors becomes a challenging task for system administrators due to the dynamics and heterogeneity of the data. System monitoring data are essentially heterogeneous temporal graphs with nodes being system entities and edges being their interactions over time. Given the complexity of such graphs, it becomes time-consuming for system administrators to manually formulate useful queries in order to examine abnormal activities, attacks, and vulnerabilities in computer systems. In this work, we investigate how to query temporal graphs and treat query formulation as a discriminative temporal graph pattern mining problem. We introduce TGMiner to mine discriminative patterns…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsGraph Theory and Algorithms · Web Data Mining and Analysis · Data Management and Algorithms
