Unsupervised Threat Hunting using Continuous Bag-of-Terms-and-Time (CBoTT)
This addresses the problem of improving threat hunting for cybersecurity analysts by offering an incremental method for anomaly detection in SIEM logs.
The paper tackles the problem of detecting malicious activities in system logs by proposing an unsupervised framework called continuous bag-of-terms-and-time (CBoTT) for anomaly-based threat hunting, which outperforms benchmarks by identifying anomalies at higher percentiles (1.82-6.46 vs. 3.25-80.92).
Threat hunting is sifting through system logs to detect malicious activities that might have bypassed existing security measures. It can be performed in several ways, one of which is based on detecting anomalies. We propose an unsupervised framework, called continuous bag-of-terms-and-time (CBoTT), and publish its application programming interface (API) to help researchers and cybersecurity analysts perform anomaly-based threat hunting among SIEM logs geared toward process auditing on endpoint devices. Analyses show that our framework consistently outperforms benchmark approaches. When logs are sorted by likelihood of being an anomaly (from most likely to least), our approach identifies anomalies at higher percentiles (between 1.82-6.46) while benchmark approaches identify the same anomalies at lower percentiles (between 3.25-80.92). This framework can be used by other researchers to conduct benchmark analyses and cybersecurity analysts to find anomalies in SIEM logs.