Causal Connections Mining Within Security Event Logs

Saad Khan; Simon Parkinson

doi:10.1145/3148011.3154476

Causal Connections Mining Within Security Event Logs

Saad Khan, Simon Parkinson

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

4 Citations (Scopus)

Abstract

Performing both security vulnerability assessment and configuration processes are heavily reliant on expert knowledge. This requirement often results in many systems being left insecure due to a lack of analysis expertise and access to specialist resources. It has long been known that a system's event log provides historical information depicting potential security threats, as well as recording configuration activities. In this paper, a novel technique is developed that can process security event logs on a computer that has been assessed and configured by a security professional, and autonomously establish causality amongst event log entries to learn performed configuration tasks. This extracted knowledge can then be exploited by non-professionals to plan steps that can improve the security of a previously unseen system

Original language	English
Title of host publication	Proceedings of the 9th International Conference on Knowledge Capture (K-CAP), (Austin, TX: 4-6 December 2017)
Publisher	Association for Computing Machinery (ACM)
Number of pages	4
ISBN (Electronic)	9781450355537
DOIs	https://doi.org/10.1145/3148011.3154476
Publication status	Published - 4 Dec 2017
Event	9th International Conference on Knowledge Capture - Hilton Garden Inn Convention Center, Austin, United States Duration: 4 Dec 2017 → 6 Dec 2017 Conference number: 9 https://k-cap2017.org/ (Link to Conference Website)

Conference

Conference	9th International Conference on Knowledge Capture
Abbreviated title	K-CAP 2017
Country/Territory	United States
City	Austin
Period	4/12/17 → 6/12/17
Internet address	https://k-cap2017.org/ (Link to Conference Website)

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 9 Industry, Innovation, and Infrastructure

Access to Document

10.1145/3148011.3154476Licence: Unspecified

http://eprints.hud.ac.uk/id/eprint/33841/Licence: Unspecified

Cite this

@inproceedings{4551724f16fe4e16b1d0a59026d9dbfe,

title = "Causal Connections Mining Within Security Event Logs",

abstract = "Performing both security vulnerability assessment and configuration processes are heavily reliant on expert knowledge. This requirement often results in many systems being left insecure due to a lack of analysis expertise and access to specialist resources. It has long been known that a system's event log provides historical information depicting potential security threats, as well as recording configuration activities. In this paper, a novel technique is developed that can process security event logs on a computer that has been assessed and configured by a security professional, and autonomously establish causality amongst event log entries to learn performed configuration tasks. This extracted knowledge can then be exploited by non-professionals to plan steps that can improve the security of a previously unseen system",

keywords = "Knowledge extraction, Automated, Association, Causal",

author = "Saad Khan and Simon Parkinson",

year = "2017",

month = dec,

day = "4",

doi = "10.1145/3148011.3154476",

language = "English",

booktitle = "Proceedings of the 9th International Conference on Knowledge Capture (K-CAP), (Austin, TX: 4-6 December 2017)",

publisher = "Association for Computing Machinery (ACM)",

address = "United States",

note = "9th International Conference on Knowledge Capture, K-CAP 2017 ; Conference date: 04-12-2017 Through 06-12-2017",

url = "https://k-cap2017.org/",

}

Khan, S & Parkinson, S 2017, Causal Connections Mining Within Security Event Logs. in Proceedings of the 9th International Conference on Knowledge Capture (K-CAP), (Austin, TX: 4-6 December 2017)., 38, Association for Computing Machinery (ACM), 9th International Conference on Knowledge Capture, Austin, Texas, United States, 4/12/17. https://doi.org/10.1145/3148011.3154476

TY - GEN

T1 - Causal Connections Mining Within Security Event Logs

AU - Khan, Saad

AU - Parkinson, Simon

N1 - Conference code: 9

PY - 2017/12/4

Y1 - 2017/12/4

N2 - Performing both security vulnerability assessment and configuration processes are heavily reliant on expert knowledge. This requirement often results in many systems being left insecure due to a lack of analysis expertise and access to specialist resources. It has long been known that a system's event log provides historical information depicting potential security threats, as well as recording configuration activities. In this paper, a novel technique is developed that can process security event logs on a computer that has been assessed and configured by a security professional, and autonomously establish causality amongst event log entries to learn performed configuration tasks. This extracted knowledge can then be exploited by non-professionals to plan steps that can improve the security of a previously unseen system

AB - Performing both security vulnerability assessment and configuration processes are heavily reliant on expert knowledge. This requirement often results in many systems being left insecure due to a lack of analysis expertise and access to specialist resources. It has long been known that a system's event log provides historical information depicting potential security threats, as well as recording configuration activities. In this paper, a novel technique is developed that can process security event logs on a computer that has been assessed and configured by a security professional, and autonomously establish causality amongst event log entries to learn performed configuration tasks. This extracted knowledge can then be exploited by non-professionals to plan steps that can improve the security of a previously unseen system

KW - Knowledge extraction

KW - Automated

KW - Association

KW - Causal

UR - https://dl.acm.org/event.cfm?id=RE112

U2 - 10.1145/3148011.3154476

DO - 10.1145/3148011.3154476

M3 - Conference contribution

BT - Proceedings of the 9th International Conference on Knowledge Capture (K-CAP), (Austin, TX: 4-6 December 2017)

PB - Association for Computing Machinery (ACM)

T2 - 9th International Conference on Knowledge Capture

Y2 - 4 December 2017 through 6 December 2017

ER -

Causal Connections Mining Within Security Event Logs

Abstract

Conference

UN SDGs

Access to Document

Other files and links

Fingerprint

Cite this