Anomaly Detection

Tensor Decomposition Methods for Cybersecurity

Tensor decomposition is a powerful unsupervised machine learning method used to extract hidden patterns from large datasets. This presentation aims to illuminate the extensive applications and capabilities of tensors within the realm of cybersecurity. We offer a comprehensive overview by encapsulating a diverse array of capabilities, showcasing the cutting-edge employment of tensors in the detection of network and power grid anomalies,identification of SPAM e-mails, mitigation of credit card fraud, and detection of malware. Additionally, we delve into the utility of tensors for classifying malware families, pinpointing novel forms of malware, analyzing user behavior,and utilizing tensors for data privacy through federated learning techniques.

General-Purpose Unsupervised Cyber Anomaly Detection via Non-Negative Tensor Factorization

Distinguishing malicious anomalous activities from unusual but benign activities is a fundamental challenge for cyber defenders. Prior studies have shown that statistical user behavior analysis yields accurate detections by learning behavior profiles …

Multi-Dimensional Anomalous Entity Detection via Poisson Tensor Factorization

As the attack surfaces of large enterprise networks grow, anomaly detection systems based on statistical user behavior analysis play a crucial role in identifying malicious activities. Previous work has shown that link prediction algorithms based on …

Anomalous Event Detection using Non-Negative Poisson Tensor Factorization

Network intrusion detection systems that are based on statistical User Behaviour Analytics play a fundamental role in the identification of anomalous agents such as malicious insiders, misused accounts, and users with compromised credentials. To this extent, there have been significant results in detecting anomalies from learned user behavior models via non-negative Poisson matrix factorization. We expand upon previous work in this project by exploiting the higher dimensional and sparse problems created by the user authentication data. An integrated multidimensional anomaly scoring method based on tensors and Poisson recommender systems is proposed. In our experiments, we build a higher-order model that can detect the accounts compromised by red-team during penetration testing activities at a large organization.