A User and Entity Behavior Analytics Log Data Set for Anomaly Detection in Cloud Computing

Research output: Chapter in Book or Conference ProceedingsBook chapterpeer-review

Abstract

Cyber criminals utilize compromised user accounts to gain access into otherwise protected systems without the need for technical exploits. User and Entity Behavior Analytics (UEBA) leverages anomaly detection techniques to recognize such intrusions by comparing user behavior patterns against profiles derived from historical log data. Unfortunately, hardly any real log data sets suitable for UEBA are publicly available, which prevents objective comparison and reproducibility of approaches. Synthetic data sets are only able to alleviate this problem to some extent, because simulations are unable to adequately induce the dynamic and unstable nature of real user behavior in generated log data. We therefore present a real system log data set from a cloud computing platform involving more than 5000 users and spanning over more than five years. To evaluate our data set for the scenario of account hijacking, we outline a method for attack injection and subsequently disclose the resulting manifestations with an adaptive anomaly detection mechanism.
Original languageGerman
Title of host publicationProceedings of the 2022 IEEE International Conference on Big Data - 6th International Workshop on Big Data Analytics for Cyber Intelligence and Defense (BDA4CID 2022)
Pages4285-4294
Number of pages10
DOIs
Publication statusPublished - 2023
Event6th International Workshop on Big Data Analytics for Cyber Intelligence and Defense (BDA4CID 2022) - Osaka, Japan
Duration: 17 Dec 202220 Dec 2022

Publication series

Name2022 IEEE International Conference on Big Data (Big Data)

Conference

Conference6th International Workshop on Big Data Analytics for Cyber Intelligence and Defense (BDA4CID 2022)
Country/TerritoryJapan
CityOsaka
Period17/12/2220/12/22

Research Field

  • Cyber Security

Cite this