Facade: High-Precision Insider Threat Detection Using Deep Contextual Anomaly Detection
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866929620718190592 |
|---|---|
| author | Kantchelian, Alex Neo, Casper Stevens, Ryan Kim, Hyungwon Fu, Zhaohao Momeni, Sadegh Huber, Birkett Bursztein, Elie Pavlidis, Yanis Buthpitiya, Senaka Cochran, Martin Poletto, Massimiliano |
| author_facet | Kantchelian, Alex Neo, Casper Stevens, Ryan Kim, Hyungwon Fu, Zhaohao Momeni, Sadegh Huber, Birkett Bursztein, Elie Pavlidis, Yanis Buthpitiya, Senaka Cochran, Martin Poletto, Massimiliano |
| contents | We present Facade (Fast and Accurate Contextual Anomaly DEtection): a high-precision deep-learning-based anomaly detection system deployed at Google (a large technology company) as the last line of defense against insider threats since 2018. Facade is an innovative unsupervised action-context system that detects suspicious actions by considering the context surrounding each action, including relevant facts about the user and other entities involved. It is built around a new multi-modal model that is trained on corporate document access, SQL query, and HTTP/RPC request logs.
To overcome the scarcity of incident data, Facade harnesses a novel contrastive learning strategy that relies solely on benign data. Its use of history and implicit social network featurization efficiently handles the frequent out-of-distribution events that occur in a rapidly changing corporate environment, and sustains Facade's high precision performance for a full year after training. Beyond the core model, Facade contributes an innovative clustering approach based on user and action embeddings to improve detection robustness and achieve high precision, multi-scale detection.
Functionally what sets Facade apart from existing anomaly detection systems is its high precision. It detects insider attackers with an extremely low false positive rate, lower than 0.01%. For single rogue actions, such as the illegitimate access to a sensitive document, the false positive rate is as low as 0.0003%. To the best of our knowledge, Facade is the only published insider risk anomaly detection system that helps secure such a large corporate environment. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2412_06700 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Facade: High-Precision Insider Threat Detection Using Deep Contextual Anomaly Detection Kantchelian, Alex Neo, Casper Stevens, Ryan Kim, Hyungwon Fu, Zhaohao Momeni, Sadegh Huber, Birkett Bursztein, Elie Pavlidis, Yanis Buthpitiya, Senaka Cochran, Martin Poletto, Massimiliano Cryptography and Security We present Facade (Fast and Accurate Contextual Anomaly DEtection): a high-precision deep-learning-based anomaly detection system deployed at Google (a large technology company) as the last line of defense against insider threats since 2018. Facade is an innovative unsupervised action-context system that detects suspicious actions by considering the context surrounding each action, including relevant facts about the user and other entities involved. It is built around a new multi-modal model that is trained on corporate document access, SQL query, and HTTP/RPC request logs. To overcome the scarcity of incident data, Facade harnesses a novel contrastive learning strategy that relies solely on benign data. Its use of history and implicit social network featurization efficiently handles the frequent out-of-distribution events that occur in a rapidly changing corporate environment, and sustains Facade's high precision performance for a full year after training. Beyond the core model, Facade contributes an innovative clustering approach based on user and action embeddings to improve detection robustness and achieve high precision, multi-scale detection. Functionally what sets Facade apart from existing anomaly detection systems is its high precision. It detects insider attackers with an extremely low false positive rate, lower than 0.01%. For single rogue actions, such as the illegitimate access to a sensitive document, the false positive rate is as low as 0.0003%. To the best of our knowledge, Facade is the only published insider risk anomaly detection system that helps secure such a large corporate environment. |
| title | Facade: High-Precision Insider Threat Detection Using Deep Contextual Anomaly Detection |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2412.06700 |