Best Papers
 A Featurization Method to Improve Anomaly Detection Performance Using Login Logs 


Vol. 47,  No. 1, pp. 58-65, Jan.  2022
10.7840/kics.2022.47.1.58


PDF Full-Text
  Abstract

Anomaly login detection is an essential element for protecting corporate data and building a secure system. When an attacker enters the correct password and successfully logs in to the server, the attacker begins looking for meaningful information in the system. At this time, by detecting anomaly login behavior of the account and restricting or revoking the privileges of the account, system loss can be reduced. In this study, a data preprocessing method was studied to improve the anomaly login detection performance by using the login log. We generated frequency headers for each event by calculating the number of times the same event repeats based on the source user, source domain, source computer, destination user, destination domain, destination computer, authentication type, logon type, authentication_orientation, and login success/failure. And one-hot encoding was performed on the data of the source user, destination user, authentication type, logon type, and frequency header. After encoding, 6 anomaly detection algorithms (ABOD, HBOS, IForest, KNN, LOF, OCSVM) were applied to compare before and after applying the proposed method, and the AUC was 43% or more (up to 50%), and the TPR was 86% or more. (up to 93%) performance was improved.

  Statistics
Cumulative Counts from November, 2022
Multiple requests among the same browser session are counted as one view. If you mouse over a chart, the values of data points will be shown.


  Cite this article

[IEEE Style]

S. Im, S. Kim, S. Shim, S. Koo, B. Cho, K. Kim, T. Kim, "A Featurization Method to Improve Anomaly Detection Performance Using Login Logs," The Journal of Korean Institute of Communications and Information Sciences, vol. 47, no. 1, pp. 58-65, 2022. DOI: 10.7840/kics.2022.47.1.58.

[ACM Style]

Sun-Young Im, Sang-soo Kim, Shinwoo Shim, Sung-mo Koo, Byoungmo Cho, Kwangsoo Kim, and Taekyu Kim. 2022. A Featurization Method to Improve Anomaly Detection Performance Using Login Logs. The Journal of Korean Institute of Communications and Information Sciences, 47, 1, (2022), 58-65. DOI: 10.7840/kics.2022.47.1.58.

[KICS Style]

Sun-Young Im, Sang-soo Kim, Shinwoo Shim, Sung-mo Koo, Byoungmo Cho, Kwangsoo Kim, Taekyu Kim, "A Featurization Method to Improve Anomaly Detection Performance Using Login Logs," The Journal of Korean Institute of Communications and Information Sciences, vol. 47, no. 1, pp. 58-65, 1. 2022. (https://doi.org/10.7840/kics.2022.47.1.58)

Search
(IN TITLE, AUTHOR, ABSTRACT,KEYWORDS)

Advanced Search ▼

POPULAR KEYWORDS
(TOP 10 KEYWORDS)

Recent Publications
(LAST 3 YEARS)






pISSN : 1226 - 4717
eISSN : 2287 - 3880