Unsupervised anomaly detection on cybersecurity data streams: a case with BETH dataset
This work addresses the problem of detecting unknown cyber threats in real-time for cybersecurity systems, but it is incremental as it applies existing stream learning methods to a new dataset.
The paper tackled unsupervised anomaly detection on cybersecurity data streams using the BETH dataset, evaluating ten algorithms from Python stream machine-learning libraries and reporting ROC-AUC metrics and processing times.
In modern world the importance of cybersecurity of various systems is increasing from year to year. The number of information security events generated by information security tools grows up with the development of the IT infrastructure. At the same time, the cyber threat landscape does not remain constant, and monitoring should take into account both already known attack indicators and those for which there are no signature rules in information security products of various classes yet. Detecting anomalies in large cybersecurity data streams is a complex task that, if properly addressed, can allow for timely response to atypical and previously unknown cyber threats. The possibilities of using of offline algorithms may be limited for a number of reasons related to the time of training and the frequency of retraining. Using stream learning algorithms for solving this task is capable of providing near-real-time data processing. This article examines the results of ten algorithms from three Python stream machine-learning libraries on BETH dataset with cybersecurity events, which contains information about the creation, cloning, and destruction of operating system processes collected using extended eBPF. ROC-AUC metric and total processing time of processing with these algorithms are presented. Several combinations of features and the order of events are considered. In conclusion, some mentions are given about the most promising algorithms and possible directions for further research are outlined.