Visible to the public Behavior-Based Community Detection: Application to Host Assessment In Enterprise Information Networks

TitleBehavior-Based Community Detection: Application to Host Assessment In Enterprise Information Networks
Publication TypeConference Paper
Year of Publication2018
AuthorsCao, Cheng, Chen, Zhengzhang, Caverlee, James, Tang, Lu-An, Luo, Chen, Li, Zhichun
Conference NameProceedings of the 27th ACM International Conference on Information and Knowledge Management
ISBN Number978-1-4503-6014-2
Keywordsanomaly detection, behavior modeling, community detection, Comparative Analysis, enterprise information network, entity embedding, graph theory, host assessment, Human Behavior, malware analysis, Metrics, privacy, pubcrawl, Resiliency

Community detection in complex networks is a fundamental problem that attracts much attention across various disciplines. Previous studies have been mostly focusing on external connections between nodes (i.e., topology structure) in the network whereas largely ignoring internal intricacies (i.e., local behavior) of each node. A pair of nodes without any interaction can still share similar internal behaviors. For example, in an enterprise information network, compromised computers controlled by the same intruder often demonstrate similar abnormal behaviors even if they do not connect with each other. In this paper, we study the problem of community detection in enterprise information networks, where large-scale internal events and external events coexist on each host. The discovered host communities, capturing behavioral affinity, can benefit many comparative analysis tasks such as host anomaly assessment. In particular, we propose a novel community detection framework to identify behavior-based host communities in enterprise information networks, purely based on large-scale heterogeneous event data. We continue proposing an efficient method for assessing host's anomaly level by leveraging the detected host communities. Experimental results on enterprise networks demonstrate the effectiveness of our model.

Citation Keycao_behavior-based_2018