Anomaly Detection in OKTA Logs using Autoencoders

TL;DR

This paper explores using autoencoders, an unsupervised machine learning technique, to improve anomaly detection in Okta logs, addressing limitations of traditional rule-based cybersecurity methods.

Contribution

It introduces a novel approach applying autoencoders to Okta logs, including data transformation and filtering for effective unsupervised anomaly detection.

Findings

Autoencoders effectively identify anomalies in Okta logs.

The method reduces false positives compared to rule-based systems.

Transforming log data is crucial for autoencoder performance.

Abstract

Okta logs are used today to detect cybersecurity events using various rule-based models with restricted look back periods. These functions have limitations, such as a limited retrospective analysis, a predefined rule set, and susceptibility to generating false positives. To address this, we adopt unsupervised techniques, specifically employing autoencoders. To properly use an autoencoder, we need to transform and simplify the complexity of the log data we receive from our users. This transformed and filtered data is then fed into the autoencoder, and the output is evaluated.