Exploration of Enterprise Server Data to Assess Ease of Modeling System Behavior
Enes Altinisik, Husrev Taha Sencar, Mohamed Nabeel, Issa Khalil, and, Ting Yu

TL;DR
This study investigates the variability and modeling challenges of enterprise server behavior using system event logs, highlighting how profiling and contextual grouping improve anomaly detection effectiveness.
Contribution
It provides an empirical analysis of server activity patterns and proposes methods to enhance behavior modeling for security detection.
Findings
Server activity is highly variable over time.
Grouping servers by service level improves rareness measurement.
Better contextual representations enhance similarity detection.
Abstract
Enterprise networks are one of the major targets for cyber attacks due to the vast amount of sensitive and valuable data they contain. A common approach to detecting attacks in the enterprise environment relies on modeling the behavior of users and systems to identify unexpected deviations. The feasibility of this approach crucially depends on how well attack-related events can be isolated from benign and mundane system activities. Despite the significant focus on end-user systems, the background behavior of servers running critical services for the enterprise is less studied. To guide the design of detection methods tailored for servers, in this work, we examine system event records from 46 servers in a large enterprise obtained over a duration of ten weeks. We analyze the rareness characteristics and the similarity of the provenance relations in the event log data. Our findings show…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Software System Performance and Reliability · Complex Network Analysis Techniques
