Host anomalies detection using autoencoders

Abstract

Traditional intrusion detection tools deal well with detecting known computer attacks but it is not enough to detect zero-day attacks. Improving computer security can be achieved by using a set of measures: signature analysis and anomaly detection. This article proposes a method for detecting abnormal Windows hosts events. The fundamental idea of the method is to build a model of normal host behavior using neural networks (autoencoders). The normal host behavior model is used to analyze the degree of abnormality of new host events. The method uses two autoencoders of different architectures to analyze events divided into two groups. The way of events digitization for groups is different. The anomaly criterion for a new event is the excess of Immediate Reconstruction Error (IRE) threshold. IRE threshold is calculated separately for each autoencoder at the training stage. The effectiveness of the method is confirmed by means of detecting malicious use of Windows system utilities and other atypical and suspicious Windows events. The article describes in detail: the algorithm for detecting abnormal Windows events, events digitization methods, neural networks architecture, the anomaly criterion and quality criteria of trained neural networks and the advantages and disadvantages of the proposed anomaly detection method.