Isaiah J. King (The George Washington University)

Lateral movement is a key stage of system compromise used by advanced persistent threats, and detecting it is no simple task. But when network host logs are abstracted into discrete temporal graphs, the problem can be reframed as anomalous edge detection in an evolving network. We have implemented a formalized approach to this problem with a framework we call Euler. It consists of a model-agnostic graph neural network stacked upon a model-agnostic sequence encoding layer such as a recurrent neural network. In this talk, we will discuss the challenges we faced comparing Euler to other link prediction and anomaly detection models, and how we justified and qualified our conclusions about its effectiveness. We proposed a more precise terminology for temporal link prediction tasks to aid in reproducibility. Assertions about the relative quality of models are backed with inferential statistics, not just performance metrics, ensuring fair comparison. Finally, we discuss the value of various metrics and data sets for anomaly detection in general.

Speaker's biography

Isaiah J. King is a Ph.D. student at the George Washington University School of Engineering and Applied Sciences and an ARCS scholar. His research interests include unsupervised machine learning on graphs, and distributed machine learning, particularly as they apply to intrusion detection systems.

View More Papers

An In-Depth Analysis on Adoption of Attack Mitigations in...

Ruotong Yu (Stevens Institute of Technology, University of Utah), Yuchen Zhang, Shan Huang (Stevens Institute of Technology)

Read More

What Storage? An Empirical Analysis of Web Storage in...

Zubair Ahmad (Università Ca’ Foscari Venezia), Samuele Casarin (Università Ca’ Foscari Venezia), and Stefano Calzavara (Università Ca’ Foscari Venezia)

Read More

Cross-Language Attacks

Samuel Mergendahl (MIT Lincoln Laboratory), Nathan Burow (MIT Lincoln Laboratory), Hamed Okhravi (MIT Lincoln Laboratory)

Read More

ScriptChecker: To Tame Third-party Script Execution With Task Capabilities

Wu Luo (Peking University), Xuhua Ding (Singapore Management University), Pengfei Wu (School of Computing, National University of Singapore), Xiaolei Zhang (Peking University), Qingni Shen (Peking University), Zhonghai Wu (Peking University)

Read More