Cyber Threat Hunting with Deep Graph Learning
Open Access Depositedthat of natural language processing. Random walks through graphs, when viewed analogously to sentences in a corpus, can be processed in much the same way as text. The penultimate chapter of this dissertation compares my previous approaches to graph-based intrusion detection to a novel, LLM-adjacent one, where we train a language model on a corpus of cybersecurity graphs and fine-tune it to predict anomalous edges. This approach allows us to predict anomalous edges with 12x higher precision than my previous approaches, and 4x higher than the current state-of-the-art, with a comparable number of parameters. This dissertation demonstrates that when cybersecurity is viewed through the lens of graph analysis, it is possible to detect anomalous activity that traditional methods miss. Attackers will continue to devise new ways of sneaking past traditional, signature-based intrusion detectors
Computer network logs can be understood as tabular rows of a database, but should they be? Logs contain information about interactions between entities
it is increasingly important to find ways to detect them through anomalous activity alone. When the complex, interrelated data contained in log files is represented as a temporal graph, attackers cannot hide behind zero-days. Should they traverse the networks protected by these algorithms, the anomalous edges they leave behind will lead us right to them.
when viewed holistically, they form a web of relationships that have occurred over time. This dissertation will demonstrate the cutting-edge deep graph learning approaches that we have developed for network log analysis when viewed through this abstraction. These approaches, when applied to cyber threat hunting, yield powerful anomaly-based intrusion detection models with high precision and efficient runtimes. First, we present a system that detects lateral movement between hosts in an enterprise network using temporal link prediction. The system consists of a novel, distributed graph neural network (GNN) architecture that performs link prediction on temporal graphs representing authentications and network flows between computers. When applied to cybersecurity data, our system could detect lateral movement with a higher true positive rate, lower false positive rate, and 16x faster than contemporary works. Second, we modify GNNs to process edges as they are streamed in real-time. This modification produces embeddings in continuous time, where the temporal ordering of edges is respected, meaning information only propagates forward through time. We applied this novel GNN architecture for provenance graph analysis of host and network logs, and it detected APT activity with higher speed and precision than the state-of-the-art. Finally, we explore what happens when we abandon GNNs altogether and bring cyber threat hunting to the frontiers of deep graph learning. Instead, we approach intrusion detection from a new perspective
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.