Anomaly Detection Support Using Process Classification

TL;DR

This paper explores inferring the originating program of system events for anomaly detection by modeling transition probabilities and applying k-nearest neighbors, demonstrating effective program identification in real-world data.

Contribution

It introduces a method combining transition probability modeling and k-NN to identify program sources from system events for improved anomaly context understanding.

Findings

Successfully infers program names from system events

Effective on real-world non-malicious data

Uses transition probabilities and k-NN approach

Abstract

Anomaly detection systems need to consider a lot of information when scanning for anomalies. One example is the context of the process in which an anomaly might occur, because anomalies for one process might not be anomalies for a different one. Therefore data -- such as system events -- need to be assigned to the program they originate from. This paper investigates whether it is possible to infer from a list of system events the program whose behavior caused the occurrence of these system events. To that end, we model transition probabilities between non-equivalent events and apply the $k$-nearest neighbors algorithm. This system is evaluated on non-malicious, real-world data using four different evaluation scores. Our results suggest that the approach proposed in this paper is capable of correctly inferring program names from system events.