Behavior Query Discovery in System-Generated Temporal Graphs

Transcription

1 Behavior Query Discovery in System-Generated Temporal Graphs Bo Zong,, Xusheng Xiao, Zhichun Li, Zhenyu Wu, Zhiyun Qian, Xifeng Yan, Ambuj K. Singh, Guofei Jiang UC Santa Barbara NEC Labs, America UC Riverside

2 Scaling Management in Complex Systems Computer security Power plants IoT Systems Large complex systems in daily life Impossible to manually monitor their states Have to resort to automation Big system monitor data Large volume: 40 GB/day for a medium-size cloud High heterogeneity: diverse data sources and data formats High dynamics: new data arriving over time Impossible to manually investigate such data Automated methods are desired, but how to fuse such monitor data for data analytics? [] Y. Zheng, H. Zhang, and Y. Yu. Detecting collective anomalies from multiple spatio-temporal datasets across different domains. SIGSPATIAL'5. [] W. R. Cheswick, S. M. Bellovin, and A. D. Rubin. Firewalls and Internet Security: Repelling the Wily Hacker. 00.

3 System Monitoring in Cybersecurity Monitored data: Syscall logs [] Each log line: Who does What at Which time Syscall log Computer system :0am: Process P created Process P :0am: P opened File F :am: P wrote to F :am: P closed F 9:pm: P created Process P 9:47pm: P opened Socket S 9:48pm: P was listening to S 0:04pm: P closed S :0pm: P created Process P 4 [] H. Yin, D. Song, M. Egele, C. Kruegel, and E. Kirda. Panorama: capturing system-wide information flow for malware detection and analysis. CCS'07.

4 Fusing Monitor Data by Temporal Graphs Nodes: Basic system entities Edges: Interactions between nodes Timestamps: Time indicating when interactions happened Syscall log F : /bin/sh S : Unix socket :0pm: Process P was listening to S :0pm: P opened File F :pm: P wrote to File F :04pm: Process P closed F :5pm: P read File F :46pm: P read F 4 4:7pm: P read F 5 4:48pm: P read Pipe F : /bin/run :04pm P : /bin/run-parts Pipe :0pm P : /bin/dash F : /usr/bin/env :5pm F 4 : /bin/run-parts 4:7pm F 5 : /etc/update-motd.d On temporal graph data, user may issue security queries, e.g., any suspicious activities in HR department servers? 4

5 Analyzing Systems through Behavior Queries Security questions are composed of system behaviors [] System behaviors: high-level events, formed by a set of system entity interactions Example: Security query from user Someone remotely accessed HR s desktop by ssh, compressed some files, and then sent the data to a remote server sshd-login Compressing files A chain of behavior queries Sending data to a remote server If we can formulate behavior queries, then we can answer security queries. But how? [] U. Bayer, I. Habibi, D. Balzarotti, E. Kirda, and C. Kruegel. A view on current malware behaviors. LEET'09. 5

6 Query Formulation: Handcrafted vs. Automated Handcrafting is infeasible Users have to know which set of basic entity interaction and their execution order Users have to repeat this process for hundreds of behaviors on different operating systems Why not use raw logs? Low recall: Raw logs include too much noise generated from other behaviors Low query efficiency: Raw logs can include thousands of interactions sshd-login Server Raw logs (Syscall logs) generated by executing sshd-login Behavior query sshd-login 6

7 Discriminative Patterns as Behavior Queries Behavior queries for sshd-login Pipe t t P: /bin/uname t P: /bin/dash t 4 P: /bin/uname Messy raw logs 00+ nodes,,000+ edges Poor usability F: /bin/uname Discriminative pattern 5 nodes, 4 edges High precision and recall 7

8 Query Discovery by Discriminative Patterns Positive set: raw logs obtained by executing target behavior multiple times Negative set: raw logs obtained by executing other behaviors multiple times Discriminative patterns: frequently appear in positive set, but rarely appear in negative set sshd-login Server Positive set Discriminative patterns Behavior query Other behaviors Negative set sshd-login Our focus: Enabling fast discriminative temporal graph pattern mining 8

9 Outline Introduction Mining Discriminative Temporal Graph Patterns TGMiner: Enabling Fast Pattern Mining Experimental Results Conclusion 9

10 Temporal Graph and Subgraph Temporal graph G = (V, E, T ) V, labeled nodes T, timestamps E V V T, edges with timestamps Temporal subgraph: Let G = (V, E, T ). G' t G, if There are two injective functions f : V ' V and τ : T ' T u' V ', u and f (u ) have same labels (node mapping) (u', v',t') E ', ( f (u), f (v),τ(t)) E (edge mapping) (u ', v ',t '), (u ', v ',t ') E ', sign(t ' t ') = sign(τ(t ') τ(t ')) 4 B 7 A B G' t G A B Time order preserved C 7 E 4 D E D G G 0

11 Temporal Graph Pattern Temporal graph pattern g = (V, E, T ) t T, t E, relative time order (u, v,t), (u', v',t') E, t t ', edges are totally ordered T-connected: (u, v,t) E, all the edges of timestamps smaller than t form a connected graph Examples 4 B A A A A 4 B B 4 B B 5 C No relative time order Not totally ordered 7 E G 4 D E g D C E G 6 D Not T-connected G and G are temporal graphs, but not patterns g is temporal graph pattern

12 Problem Statement Input Positive graph set G p Negative graph set G n Output: Discriminative patterns g that maximize F( freq(g p, g), freq(g n, g)) freq(g, g) = {G g t G G G} G Number of Graphs in G containing g F(x, y), discriminative function that rewards high x but penalizes high y, such as F(x, y) = log(x / (y +ε)), ε =0 6 [] Prefer patterns appearing frequently in G p, rarely in G n TGMiner: Fast discriminative pattern mining for temporal graphs [] N. Jin, C. Young, and W. Wang. GAIA: Graph Classification using Evolutionary Computation. SIGMOD 0

13 Outline Introduction Mining Discriminative Temporal Graph Patterns TGMiner: Enabling Fast Pattern Mining Experimental Results Conclusion

14 TGMiner Overview Key components Pattern growth: Guide search in pattern space Pruning: Skip unpromising search branches Prune Technical challenges Pattern growth: how to avoid repeated search and achieve full coverage with small overhead Pruning: how to discover unpromising search branches with small overhead 4

15 Pattern Growth: Temporal Graph Isomorphism Temporal graph isomorphism: Static graph isomorphism G' = t G G' t G G t G' Temporal graph isomorphism Combinatorial #growth paths [,] Costly graph isomorphism check Costly pattern growth algorithm Implication: Avoid repeated search with small overhead Unique growth path: Growing with increasing temporal order One can decide temporal graph isomorphism in linear time [] X. Yan and J. Han. gspan: Graph-based substructure pattern mining. ICDM 0 [] X. Yan, H. Cheng, J. Han, and P. S. Yu. Mining significant graph patterns by leap search. SIGMOD'08. 5

16 Pattern Growth: Algorithms Principle : Growing patterns in increasing time 4 Principle : Three ways to keep T-connected Forward Backward Inward Result: Following Principle and, one can perform pattern growth with full coverage 6

17 Skip Unpromising Branches: Subgraph Pruning Intuition g g has been discovered. If g t g, can we prune branches of g? g The sub-tree under g has already been explored. When g t g, we can prune g if the following conditions hold Node labels in g \ g are never used in g s growth There is only one node mapping between g and g The edge of largest timestamp in g can only match the edge of largest timestamp in g These conditions can be checked in linear time 7

18 Skip Unpromising Branches: Supergraph Pruning Intuition... g has been discovered. If g t g, can we prune branches of g? g g The sub-tree under g has already been explored. 4 4 When g t g, we can prune g if the following conditions hold g is not a descendent of g, and they have same number of nodes There is only one node mapping between g and g g and g have same number of matches in G p and G n These conditions can be checked in linear time 4 8

19 Outline Introduction Mining Discriminative Temporal Graph Patterns TGMiner: Enabling Fast Pattern Mining Experimental Results Conclusion 9

20 Experiment Setup Temporal graphs generated from real-life system behaviors Small Medium Large Behavior Avg. #nodes Avg. #edges Total #labels #graphs bzip-decompress 5 00 gzip-decompress wget-download ftp-download scp-download gcc-compile g++-compile ftpd-login ssh-login sshd-login apt-get-update apt-get-install background Positive Negative 0

21 Behavior Query Accuracy Behavior queries can be formulated by Keyword set, such as process name, file name, etc. (Keyword) Discriminative non-temporal graph pattern (Non-Temporal) Discriminative temporal graph pattern (Temporal, our method) Precision Recall Keyword Non-Temporal Temporal Keyword Non-Temporal Temporal bzip 00% 00% 00% 00% 00 00% wget-download 96.5% 00% 00% 9.6% 9.4% 9.4% scp-download.8% 59.4% 00%.% 9.% 9.% g++-compile 7.4% 9.% 95.% 84.5% 85.% 85.% ftpd-login 76.6% 8.8% 94.% 00% 89.7% 86.8% sshd-login 4.4% 59.6% 99.9% 99.8% 99.9% 99.9% apt-get-install 68.% 8.7% 95.7% 5.6% 86.% 8.9% Average 68.5% 8.% 97.4% 78.4% 9.9% 9.% Remark: Discriminative temporal graph patterns significantly outperform baseline methods on precision, with comparable recall.

22 Response Time Baseline algorithms SubPrune: Only use subgraph pruning SupPrune: Only use supergraph pruning PruneVF/PruneGI/LinearScan: Subgraph checking by VF [] /Graph indexing []/LinearScan Response time (second) TGMiner PruneGI SubPrune LinearScan PruneVF SupPrune Response time (second) TGMiner PruneGI SubPrune LinearScan PruneVF Response time (second) TGMiner PruneGI SubPrune LinearScan PruneVF 0 Mining Algorithms 0 Mining Algorithms 0 Mining Algorithms Small behaviors Medium behaviors Large behaviors Remark: TGMiner is up to 0 times faster than all the baselines across all cases [] L. P. Cordella, P. Foggia, C. Sansone, and M. Vento. A (sub) graph isomorphism algorithm for matching large graphs. TPAMI'04. [] B. Zong, R. Raghavendra, M. Srivatsa, X. Yan, A. K. Singh, and K.-W. Lee. Cloud service placement via subgraph matching. ICDE'4.

23 Outline Introduction Mining Discriminative Temporal Graph Patterns TGMiner: Enabling Fast Pattern Mining Experimental Results Conclusion

24 Conclusion Behavior queries are critical in system analytics Impractical to manually form such queries Our idea: Automating query formulation by discriminative temporal graph pattern mining TGMiner: Enabling fast pattern mining Utilizing intrinsic properties in temporal graphs Fast pattern space exploration Effective pattern space pruning TGMiner is up to 0 times faster than baselines Behavior queries formulated by discovered patterns achieve high precision (97%) and recall (9%) 4

25 Acknowledgement This research is supported by NEC Labs, America Army Research Lab under cooperative agreement W9NF (NS-CTA) NSF IIS-954 and IIS

26 Behavior Query Discovery in System-Generated Temporal Graphs Speaker: Ambuj K. Singh Bo Zong,, Xusheng Xiao, Zhichun Li, Zhenyu Wu, Zhiyun Qian, Xifeng Yan, Ambuj K. Singh, Guofei Jiang UC Santa Barbara NEC Labs, America UC Riverside 6

27 Handling Concurrent Edges in Patterns Concurrent edges: edges of same timestamps in same patterns gspan[] TGMiner + gspan A sequence of concurrent subgraphs Adding edge of larger timestamp: TGMiner growth Adding edge of same timestamp: gspan growth Larger overhead on pruning TGMiner Static pattern Temporal pattern with concurrent edges Temporal pattern Pattern Space [] X. Yan and J. Han. gspan: Graph-based substructure pattern mining. ICDM 0 7