Collaborative Alerts Ranking for Anomaly Detection
Ying Lin, Zhengzhang Chen, Cheng Cao, Lu-an Tang, Kai Zhang, Zhichun, Li, Haifeng Chen, and Guofei Jiang

TL;DR
This paper introduces CAR, a framework that combines temporal and content analysis of heterogeneous alerts to improve anomaly detection accuracy and scenario reconstruction in enterprise security.
Contribution
CAR is a novel framework that simultaneously models temporal dependencies and content correlations in alerts for better ranking and scenario understanding.
Findings
CAR accurately identifies true positive alerts.
CAR successfully reconstructs attack scenarios.
Experiments demonstrate improved detection performance.
Abstract
Given a large number of low-level heterogeneous categorical alerts from an anomaly detection system, how to characterize complex relationships between different alerts, filter out false positives, and deliver trustworthy rankings and suggestions to end users? This problem is motivated by and generalized from applications in enterprise security and attack scenario reconstruction. While existing techniques focus on either reconstructing abnormal scenarios or filtering out false positive alerts, it can be more advantageous to consider the two perspectives simultaneously in order to improve detection accuracy and better understand anomaly behaviors. In this paper, we propose CAR, a collaborative alerts ranking framework that exploits both temporal and content correlations from heterogeneous categorical alerts. CAR first builds a tree-based model to capture both short-term correlations and…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Anomaly Detection Techniques and Applications · Advanced Malware Detection Techniques
