Potential Malicious Users Discrimination with Time Series Behavior Analysis

Transcription

1 Murat Semerc Al Taylan Cemgl Department of Computer Engneerng, Bogazc Unversty, 34342, Bebek, Istanbul, Turkey Bulent Sankur Department of Electrcal & Electroncs Engneerng, Bogazc Unversty, 34342, Bebek, Istanbul, Turkey Abstract Dscrmnatng the malcous users n a network s crucal n protectng the network enttes and preventng any ongong attacks. In an organzed attack, a group users are supposed to behave synchronously n the same manner. In ths study, we partcularly focus on organzed attacks where the attackers create a hgh volume of requests to overwhelm the server under heavy resource consumpton. We propose a novel behavor analyss based on the tme seres algnment kernel and spectral clusterng to determne the group of users that concurrently perform smlar behavors (or dssmlar behavor to that of nnocent users). We experment the proposed model on the smulated data. 1. Introducton Analyss of tme seres for classfcaton, predcton, change and outler detecton has been actve research topcs for decades wth partcular focus on fnancal markets (Gupta et al., 2014). Among the plethora of methods proposed one can menton: ) methods that map the tme seres nto a new feature space, such as spectral entropy, autocorrelaton etc. (Hyndman et al., 2015); ) kernel methods for tme-seres classfcaton wth emphass on sequence algnment (Cutur, 2011; Svaramakrshnan et al., 2007; Chen et al., 2013); ) clusterng tme seres wth a combned dstance functon of trangle smlarty and dynamc tme warpng dstance (Zhang et al., 2011); v) approaches fttng the data to a number of possble models, such as hdden Markov models and autoregressve movng average, and clusterng the data based on model nstance wth the best ft (Oates et al., 1999; Xong & Yeung, 2002); v) sngular Proceedngs of the 33 rd Internatonal Conference on Machne Learnng, New York, NY, USA, JMLR: W&CP volume 48. Copyrght 2016 by the author(s). spectral analyss where data s embedded, the embeddng matrx decomposed and reconstructed nto trend, nose and oscllatory components. In ths study, our goal s to buld an anomaly detector that analyzes the behavor of multple tme seres n order to dscrmnate the set of malcous users n a cyber attack scenaro. The underlyng assumpton s that n a cyber attack, the attacker group would show correlated behavor patterns and act n a concurrent manner (e.g. botnet attacks). To ths purpose, we frst develop a measure of user behavor smlarty based on the types and tmngs of ther actons. Then, we use spectral clusterng technques to dscrmnate the malcous users from the ordnary ones. The paper s organzed as follows: Secton 2 dscusses the method to algn two sequences of dfferent length, presents our sequence algnment kernel and defnes the parwse heat kernel. Secton 3 elaborates on the dscrmnate the users. In Secton 4, a heurstcs for automatc selecton of the attacker group s proposed, and the complete algorthm s gven. Experments results and dscusson of future research drectons are gven n Secton 5 and Secton 6, respectvely. 2. Sequence Algnment and the Proposed Kernel One way to express the smlarty between two sequences of possbly dfferent length s by the sum of smlartes of all ther possble algnments, wth no par repetton. In ths method, whle proceedng n the algnments, we allow ether only one member to vary or both of the members to vary smultaneously. Fgure 1 shows an example of all possble algnments for two sequences, whch, respectvely, have lengths two and three. In the specfc example there are 5 possble algnments. Thus, the smlarty of two sequences wll be hgher f they have hgher memberparwse smlarty values. In our work the sequences correspond to the message sent by the termnals, characterzed

2 x 1, y 2 x 1, y 1 x 2, y 2 x 2, y 1 x 3, y 2 x 3, y 1 Fgure 1. All possble algnments for x = {x 1, x 2, x 3} and y = {y 1, y 2}, where x and y j are denoted as members. by ther types and tme stamps. (x 1, y 1 ), (x 1, y 2 ), (x 2, y 2 ), (x 3, y 2 ) (x 1, y 1 ), (x 2, y 2 ), (x 3, y 2 ) (x 1, y 1 ), (x 2, y 1 ), (x 2, y 2 ), (x 3, y 2 ) (x 1, y 1 ), (x 2, y 1 ), (x 3, y 2 ) (x 1, y 1 ), (x 2, y 1 ), (x 3, y 1 ), (x 3, y 2 ) The smlarty of two sequences s a functon of parwse smlarty of sequence members. Thus, the smlarty of two sequences s hgher f they have hgh overall parwse smlarty values. A global algnment kernel has been proposed n (Cutur et al., 2007), whch uses dynamc programmng to compute the smlarty of all possble algnments of two sequences. We use a varaton of ths algorthm as detaled n Algorthm 1, where we employ a parwse heat kernel that s based on the Mahalanobs dstance and dfferences of tme stamps. The sequence algnment kernel for two sequences of length, respectvely, m and n, s gven as k(x, Y) = T n+1,m+1. Ths kernel consders all possble algnments of tme stamps of the two sequences, sums these terms weghted by the parwse kernel functon, κ(x, y j ). Here κ(x, y j ), measures the smlarty of two tme stamped message events x and y j, and each such vector ncorporates the qualfer for the type of message one of the d possble message types) and the tme of arrval of the message. After the kernel matrx for all user pars s obtaned, we unt-dagonal normalze the kernel matrx n order to elmnate scalng ssues: k (X, Y) = k(x, Y) k(x, X) k(y, Y) k (X, Y) [0, 1] (1) Algorthm 1 Global Algnment Kernel 1: For any two gven user behavor sequences X = (x 1,..., x n ), X R (d+1) n and Y = (y 1,..., y m ), Y R (d+1) m n a state space Ψ, create T R (n+1) (m+1). 2: Set the members n the frst row and n the frst column of T to zero (T 1,: = T :,1 = 0). Set T 1,1 = 1. 3: for = 2 to n + 1 do 4: for j = 2 to m + 1 do 5: T,j = (T,j 1 +T 1,j 1 +T 1,j )κ(x 1, y j 1 ) 6: end for 7: end for 8: Return T n+1,m+1 After ths normalzaton, smlar behavng user pars get values close to 1 and the dssmlar pars get values close to 0. Each users network actons are characterzed by the multtme seres, each seres correspondng to the ordered tmestamped sequence of one type of message. At any one tme at most one type of message can be sent. Thus, for a message vector x = [x 1, x 2,..., x d ], x s {0, 1} and s x s = 1, where d s the number of message types. Wthn an observaton nterval, users can send arbtrary number of dfferent messages so that messagng event sequences can have dfferent lengths. A kernel functon (the parwse heat functon) for any two tme-stamped message vector, x = (x, t x ) and y j = (y j, t y j ) s evaluated as: κ((x, t x ), (y j, t y j )) = exp( γd(x, y j) ρ t x t y j ) (2) where D(x, y j ) s a dstance functon such as Eucldean or Mahalanobs dstance. The squared Mahalanobs dstance for a gven Mahalanobs matrx, M, can be evaluated as follows: D(x, y j) = (x y j) M(x y j) (3) Note that κ((x, t x ), (y j, t y j )) = 1 ff x == y j and t x == t y j. 3. Spectral Clusterng A smlarty matrx s created of the users from the parwse user-to-user smlartes as n Equaton 1. The smlarty matrx then corresponds to a weghted adjacency graph. In order to partton ths graph such that users wth smlar messagng behavor are collected n the same sub-graph. To ths effect, we have used a spectral clusterng algorthm. Such algorthms are conceved to realze graph parttonng solutons n clusterng problems, and n the lterature there are varous spectral clusterng algorthms (Luxburg, 2007).

3 We have appled the normalzed spectral clusterng algorthm over the kernel matrx obtaned from the user behavors, K (a U U matrx where U s the set of users). Ths matrx s also nterpreted as the weghted adjacency matrx (Sh & Malk, 2000) of a fully connected graph. Each user s a vertex n ths graph whle the edge between two users s ther messagng behavor smlarty. We am to partton the graph nto two sub-graphs such that the malcous users, typcally synchronzed and organzed, fall nto one cluster, and the rest s n the other cluster. The degree of l th user s evaluated as: U d l = K (l, u) (4) u=1 The degree matrx D s a dagonal matrx whose dagonal elements conssts of degree values, d 1, d 2,..., d U. The Laplacan matrx s evaluated as n Equaton 5 and spectral clusterng algorthm s gven n Algorthm 2. L = D K (5) concentraton to malcous users. Ths algorthm based on the heurstcs that malcous users must be somewhat coordnated to mount an attack and therefore the data vectors must concentrate along a few egenvectors s gven n Algorthm 3. Algorthm 3 Cluster Selecton Heurstcs 1: For the gven cluster label vector C, determne the two clusters, C 1 and C 2. 2: For the two clusters, evaluate the sample co-varance matrx of message vectors. 3: f a cluster has 0 co-varance matrx then 4: Return the cluster wth 0 co-varance matrx. 5: else 6: Evaluate the egenvalues of the cluster co-varance matrces. 7: For each matrx, evaluate the proportonal egenvalues wth respect to the total sum of egenvalues. 8: Return the cluster wth the hghest maxmum proportonal egenvalue. 9: end f Algorthm 2 Normalzed Laplacan Spectral Clusterng 1: Gven K, evaluate D and L, whch are all n R U U. 2: Compute the frst two egenvectors v 1 and v 2 of the two smallest egenvalues 0 = λ 1 < λ 2 for the generalzed egenproblem Lv = λdv. 3: Augment v 1 and v 2 to obtan V R U 2. Use the rows of V as the new feature vectors n the mapped space, y R 2. Apply k-means clusterng wth k = 2. 4: Return the cluster label vector C from k-means clusterng. 4. Assgnment of Malcous Users to a Cluster We ntend to cluster the users nto two sets: Potentally malcous users, characterzed by repettve and correlated behavors, and the rest of users, characterzed by uncoordnated and dverse behavors. Once the two clusters are formed, then the fnal task s that of determnng that of attackers, for whch we use a heurstc algorthm. For each of the two clusters, we compute the sample covarance matrx of the user message sequence vectors n that cluster. Recall that the elements of vectors conssts of the message types and ther tme stamps. Snce the malcous user cluster s assumed to consst of smlar messagng behavors, such message vectors are expected to be more strongly algned along a few partcular axes. In fact, n the extreme case when all messages n the cluster are of the same type and are perfectly synchronzed, the sample co-varance matrx would be the 0 matrx. Therefore, we assgn the cluster wth sgnfcantly hgher egenvalue Puttng all of these steps together, the algorthm to dscrmnate the malcous users s summarzed n Algorthm 4.. Algorthm 4 Potental Malcous Users Dscrmnaton 1: Set the weght parameters γ and ρ of the parwse heat kernel. 2: Evaluate the kernel matrx K such that (U, U j ) U U, we have K,j = k(u, U j ) as defned n Algorthm 1, where U, U j are the tme-stamped message sequences of th and j th users, respectvely and U s the set of all user sequences. 3: Unt-dagonal normalze K to obtan K. 4: Apply symmetrc normalzed Laplacan spectral clusterng over K such that # clusters = 2, as defned n Algorthm 2. 5: Use cluster label vector C returned by spectral clusterng n clusterng selecton heurstc as defned n Algorthm 3. 6: Return the cluster selected by the heurstcs as the set of malcous users. 5. Experments To evaluate the performance of the proposed algorthm we mplement a smulaton setup, where we create varable length sequences for the normal and malcous users (attackers). In our setup, we assume that n any nstance of attack, the attackers choose and send one type of message, and furthermore ther tmngs are very close. We use the Mahalanobs dstance n Equaton 3, whch s calculated as

4 the nverse of the sample co-varance matrx of the number of messages observed wthn a tme nterval (M = Σ 1 ). In the smulatons, the system s sampled at 1 second ntervals. Users can choose from 5 dfferent types of messages and they can send from 1 up to 5 messages of any type n a 1 second nterval. We have set the attack strength to three levels n terms of the number of messages an attacker can send: Low-level (3-10), md-level (5-10) and hgh-level (10-15). The smulaton envronment s dmensoned for 100 users n the system. We have demonstrated the performance of the malcous user detecton system as a functon of varatons n the attack duraton, the proporton of attackers and the magntude of attack. The attack duraton s represented as at whch nterval quarter the attack starts. The attack can start at tme 0.0; 0.25; 0.5; 0.75 second wthn a tme nterval of 1 second. Snce we know the labels n the smulated data, we can show the performance of the proposed system n terms F- Measure. The deal case would be when F-measure s 1, whch can be obtaned only when there s no falsely accused attackers (.e., P = 1) and all the attackers are dentfed. Precson (P) = # assgned true attackers # assgned attackers Recall (R) = # assgned true attackers # all attackers F-Measure (F) = 2 P R P + R Fgure 2 shows an example where our algorthm has successfully detected the malcous user groups accordng to the computed kernel. The uppermost sub-fgure s the ground-truth label matrx (K,j = 1 f and only f both u and u j are attackers). The second (md) sub-fgure s the computed kernel matrx. The bottom sub-fgure shows the cluster label matrx obtaned accordng to the Algorthm 4. Fgure 3 shows the effect of attack duraton on the detecton performance. Recall that, ndependent of the duraton of the attack, the number of messages that an attacker sends s wthn a fxed nterval. Thus, f the attack duraton s long (e.g., attack starts at 0.25 sec) then the messages are more dspersed n tme; on the contrary, f the attack duraton s short (e.g., attack starts at 0.75 sec), then all messages are concentrated wthn a shorter nterval and our algorthm can detect them more accurately, snce the parwse heat kernel returns hgher values when the messages have been sent wth close tmngs. The effect of ncreased attacker number s shown n Fgure 4. The hgher the number of attackers n the system, the more accurately the algorthm detects them. It detects all (6) (7) (8) Fgure 2. Detected attackers on smulated data usng spectral clusterng Fgure 3. The Effect of Attack Duraton for Fxed Number Attackers the attackers almost wthout any false alarms. Not surprsngly, n both cases, the attackers are detected more accurately when the ntensty of the attack becomes hgher. 6. Concluson and Future Work We have proposed a novel method to fnd the group of attackers wthn a group of users and tested t usng smulaton data. The attackers are characterzed by coordnated message sendng behavors, smlar to the botnet DDoS attacks. The proposed method dscrmnates the attackers from the vctms usng smlartes between them. Each user s regarded as a tme seres where each message s represented as a unt vector. A sequence algnment kernel s used to measure smlarty between the message sequences and ther tmngs. Then the users are clustered nto two groups usng spectral clusterng. Fnally, a heurstcs s appled for autonomous attacker cluster selecton. The performance of the proposed method mproves f the attackers send hgh number of messages or they send the messages n bursts n small tme ntervals. Smlarly, the method performs more accurately f the number of attackers ncrease.

5 Luxburg, U. A tutoral on spectral clusterng. Statstcs and Computng, 17(4): , Oates, T., Frou, L., and Cohen, P.R. Clusterng tme seres wth hdden markov models and dynamc tme warpng. In Proceedngs of the IJCAI-99 Workshop on Neural, Symbolc, and Renforcement Learnng Methods for Sequence Learnng, Fgure 4. The Effect of the Number of Attackers for a Fxed Attack Duraton Acknowledgements Ths study s a Bogazc Unversty - NETAS collaboraton and t s funded wth TEYDEB project number , Realzaton of Anomaly Detecton and Preventon wth Learnng System Archtectures, Qualty Improvement, Hgh Rate Servce Avalablty and Rch Servces n a VoIP Frewall Product, by the Scentfc and Technologcal Research Councl Of Turkey (TUBITAK). NOVA V- Gate s a trademark cyber-securty product of NETAS. Sh, J. and Malk, J. Normalzed cuts and mage segmentaton. IEEE Transactons on Pattern Analyss and Machne Intellgence, 22(8): , Svaramakrshnan, K. R., Karthk, K., and Bhattacharyya, C. Kernels for large margn tme-seres classfcaton. In 2007 Internatonal Jont Conference on Neural Networks, pp , Aug Xong, Y. and Yeung, D.-Y. Mxtures of arma models for model-based tme seres clusterng. In Proceedngs of the IEEE Internatonal Conference on Data Mnng, Zhang, X., Lu, J., Du, Y., and Lv, T. A novel clusterng method on tme seres data. Expert Systems wth Applcatons, 38(9): , References Chen, H., Tang, F., Tno, P., and Yao, X. Model-based kernel for effcent tme seres analyss. In Proceedngs of the 19th ACM SIGKDD Internatonal Conference on Knowledge Dscovery and Data Mnng, KDD 13, pp , New York, NY, USA, ACM. Cutur, M. Fast global algnment kernels. In Proceedngs of the 28th Internatonal Conference on Machne Learnng, ICML 2011, Bellevue, Washngton, USA, June 28 - July 2, 2011, pp , Cutur, M., Vert, J. P., Brkenes, O., and Matsu, T. A kernel for tme seres based on global algnment. In Proceedngs of IEEE Internatonal Conference on Acoustcs, Speech and Sgnal Processng 2007 (ICASSP 07), volume 2, pp , Gupta, M., Gao, J., Aggarwal, C. C., and Han, J. Outler detecton for temporal data: A survey. IEEE Transactons on Knowledge and Data Engneerng, 26(9): , Hyndman, R. J., Wang, E., and Laptev, N. Large-scale unusual tme seres detecton. In IEEE Internatonal Conference on Data Mnng Workshop, ICDMW 2015, Atlantc Cty, NJ, USA, November 14-17, 2015, pp , 2015.